1200KM / detection
T1134.002 Create Process with Token — Detection Rules
Detection workspace for T1134.002 Create Process with Token: 6 Sigma sources, 0 Atlas concepts and 0 anomaly models. No live detection validation.
Source-backed rule directory
- Meterpreter or Cobalt Strike Getsystem Service Installation - Security · test · high · {"product":"windows","service":"security","definition":"The 'System Security Extension' audit subcategory need to be enabled to log the EID 4697"}
- Meterpreter or Cobalt Strike Getsystem Service Installation - System · test · high · {"product":"windows","service":"system"}
- Potential Meterpreter/CobaltStrike Activity · test · high · {"category":"process_creation","product":"windows"}
- PUA - AdvancedRun Execution · test · medium · {"product":"windows","category":"process_creation"}
- PUA - AdvancedRun Suspicious Execution · test · high · {"product":"windows","category":"process_creation"}
- Suspicious Child Process Created as System · test · high · {"category":"process_creation","product":"windows","definition":"Requirements: ParentUser field needs sysmon >= 13.30"}
Atlas deterministic concepts
No exact concept selected.
Anomaly models
No exact Atlas model in this snapshot.
ATT&CK analytic guidance
DET0456 Behavior-chain detection for T1134.002 Create Process with Token (Windows)
AN1253 Analytic 1253
A process (often after stealing/creating a token) calls CreateProcessWithTokenW/CreateProcessAsUserW or uses runas to spawn a **new** process whose security context (SID/LogonId/IntegrityLevel) differs from its parent. Chain: (1) suspicious command/API → (2) privileged handle or token duplication/open → (3) new child process running as another user / higher integrity → (4) optional follow‑on privileged/lateral actions.
Connected ecosystem references
Linked tags
Simulation, tools and telemetry
Threat actor context
These are explicit actor-to-technique associations in the existing Threat Matrix snapshot, not attribution of an event or proof that a detector identifies the actor. No tool-to-actor relationship is inferred.
Existing anomaly research
Pinned research references. No browser attack runner, live simulation result or validated detector is asserted. Source mappings and validation limits are preserved. ATT&CK / Atomic provenance · Detection provenance.