1200KM / detection
T1134 Access Token Manipulation — Detection Rules
Detection workspace for T1134 Access Token Manipulation: 2 Sigma sources, 1 Atlas concepts and 0 anomaly models. No live detection validation.
Source-backed rule directory
- HackTool - NoFilter Execution · test · high · {"product":"windows","service":"security","definition":"Requirements: Audit Filtering Platform Policy Change needs to be enabled"}
- Suspicious SYSTEM User Process Creation · test · high · {"category":"process_creation","product":"windows"}
Atlas deterministic concepts
T1134 Access Token Manipulation
MATCH(token_duplication_or_impersonation_event) AND process NOT_IN approved_impersonation_processes -> ALERTAnomaly models
No exact Atlas model in this snapshot.
ATT&CK analytic guidance
DET0283 Behavior-chain detection for T1134 Access Token Manipulation on Windows
AN0786 Analytic 0786
Detection of suspicious token manipulation chains: use of token-related APIs (e.g., LogonUser, DuplicateTokenEx) or commands (runas) → spawning of a new process under a different security context (e.g., SYSTEM) → mismatched parent-child process lineage or anomalies in Event Tracing for Windows (ETW) token/PPID data → abnormal lateral or privilege escalation activity.
Connected ecosystem references
Linked tags
Simulation, tools and telemetry
Threat actor context
These are explicit actor-to-technique associations in the existing Threat Matrix snapshot, not attribution of an event or proof that a detector identifies the actor. No tool-to-actor relationship is inferred.
Existing anomaly research
Complete technique engineering workbook
Collection configuration and event examples · Anomaly models and design worksheet · Tools and documented software · Simulation procedures · Offline synthetic collection check
Exact source tags are not semantic relevance verdicts. Review actual rule conditions and observation points; imported rules are not backend-compiled or live-validated.
Pinned research references. No browser attack runner or production-validated detector is asserted. Imported procedures remain unvalidated; any bounded lab evidence has its own scope. ATT&CK / Atomic provenance · Detection provenance.