Adversaries may make new tokens and impersonate users to escalate privileges and bypass access controls. For example, if an adversary has a username and password but the user is not logged onto the system the adversary can then create a logon session for the user using the `LogonUser` function.(Citation: LogonUserW function) The function will return a copy of the new session's access token and the adversary can use `SetThreadToken` to assign the token to a thread. This behavior is distinct from [Token Impersonation/Theft](https://attack.mitre.org/techniques/T1134/001) in that this refers to creating a new user token instead of stealing or duplicating an existing one.

Linked Issues

Issuelinks
Linktyp Issue
is related to Techniques
is blocked by Privileged Account Management
is blocked by Behavior‑chain detection for T1134.003 Make and Impersonate Token (Windows)
is blocked by User Account Management
is blocked by Access Restriction For Change
is blocked by Secure Baseline Configurations
is blocked by Separation of Duties (SoD)
is blocked by Identification & Authentication for Organizational Users
is blocked by Account Management
is blocked by Access Enforcement
is blocked by Least Privilege
Impressum Deutsch Englisch