Skip to content

Token Impersonation/Theft

Subtechnique · ATTACK:enterprise:T1134.001

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:enterprise:T1134.001",
  "title": "Token Impersonation/Theft",
  "type": "Subtechnique",
  "source_url": "https://attack.mitre.org/techniques/T1134/001",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--86850eff-2729-40c3-b85e-c4af26da4a2d",
  "external_id": "T1134.001",
  "domain": "enterprise",
  "created": "2020-02-18T16:39:06.289Z",
  "modified": "2026-05-12T15:12:00.686Z",
  "version": "2.0",
  "aliases": [

  ],
  "tactics": [
    "stealth",
    "privilege-escalation"
  ],
  "source_references": [
    {
      "source_name": "DuplicateToken function",
      "url": "https://learn.microsoft.com/en-us/windows/win32/api/securitybaseapi/nf-securitybaseapi-duplicatetoken"
    }
  ]
}

Explicit source assertions (24)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:S0182 → uses → ATTACK:enterprise:T1134.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0b10d358-b59f-4fc0-8eaf-37352be9c80b

Microsoft FinFisher March 2018 · FinFisher Citation

ATTACK:enterprise:S9057 → uses → ATTACK:enterprise:T1134.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--152e6822-7127-4384-bb4c-f6121ed36ae6

Mandiant_UNC1549_Nov2025

ATTACK:enterprise:S0367 → uses → ATTACK:enterprise:T1134.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2b16958e-8c41-4342-87d8-f98b42548724

Binary Defense Emotes Wi-Fi Spreader · emotet_hc3_nov2023

ATTACK:enterprise:S9033 → uses → ATTACK:enterprise:T1134.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2c37e56a-4657-41e4-8b94-abe5c3a22674

ESET_MuddyWater_Dec2025

ATTACK:enterprise:S1229 → uses → ATTACK:enterprise:T1134.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3db593a2-671e-45e6-b0a0-f48f2e8029dd

Havoc Framework Documentation

ATTACK:enterprise:S0603 → uses → ATTACK:enterprise:T1134.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3ee76373-418f-43af-adb5-3c0fcb7f080e

Nicolas Falliere, Liam O Murchu, Eric Chien February 2011

ATTACK:enterprise:C0038 → uses → ATTACK:enterprise:T1134.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--45a8a431-8465-4f6e-8258-817d919a6a52

Microsoft Albanian Government Attacks September 2022

ATTACK:enterprise:M1018 → mitigates → ATTACK:enterprise:T1134.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4b3685f7-194e-466e-82a0-f8f112b224c1

ATTACK:enterprise:S0154 → uses → ATTACK:enterprise:T1134.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--56ff911a-d7bb-4176-8e1f-bf0f46cc7f89

cobaltstrike manual · Cobalt Strike Manual 4.3 November 2020

ATTACK:enterprise:T1134.001 → subtechnique-of → ATTACK:enterprise:T1134

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--60d24337-4634-4eef-9d7e-033949228869

ATTACK:enterprise:S1011 → uses → ATTACK:enterprise:T1134.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--63f6acf5-04d5-4a77-874b-77c6416c5701

Tarrask scheduled task

ATTACK:enterprise:S0692 → uses → ATTACK:enterprise:T1134.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6b5705c3-4508-4623-b542-1fb1fbef2a47

GitHub SILENTTRINITY Modules July 2019

ATTACK:enterprise:S0570 → uses → ATTACK:enterprise:T1134.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6edd6f1b-3907-4013-b2e0-ceb03ccf427a

Crowdstrike Indrik November 2018

ATTACK:enterprise:S0140 → uses → ATTACK:enterprise:T1134.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--755bc45a-9048-4f58-b405-2ea8329328a1

McAfee Shamoon December 2018

ATTACK:enterprise:S0439 → uses → ATTACK:enterprise:T1134.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--874148d5-d7cb-43c2-905f-1582f90005f6

ESET Okrum July 2019

ATTACK:enterprise:S0456 → uses → ATTACK:enterprise:T1134.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a5848e5c-0a64-44f2-9432-4d503baea628

CheckPoint Naikon May 2020

ATTACK:enterprise:G0007 → uses → ATTACK:enterprise:T1134.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b719d37b-8f0e-4704-b21d-8977a5c7cceb

FireEye Op RussianDoll

ATTACK:enterprise:S0496 → uses → ATTACK:enterprise:T1134.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--bab712d9-69d6-49d0-b063-8f957f3ea222

McAfee Sodinokibi October 2019

ATTACK:enterprise:S9036 → uses → ATTACK:enterprise:T1134.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c6fd30bf-8d96-4da0-855d-84a05fae3be8

ESET_MuddyWater_Dec2025

ATTACK:enterprise:S0192 → uses → ATTACK:enterprise:T1134.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d17517a1-f941-46a0-bcb6-d2a5b94cb24b

ATTACK:enterprise:M1026 → mitigates → ATTACK:enterprise:T1134.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d42d35c6-de42-4a3b-ada1-da6e87023192

Microsoft Create Token · Microsoft Replace Process Token · Microsoft runas

ATTACK:enterprise:S1081 → uses → ATTACK:enterprise:T1134.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--dd28aa9c-762c-4726-b402-6536bae9490c

BitDefender BADHATCH Mar 2021

ATTACK:enterprise:S0623 → uses → ATTACK:enterprise:T1134.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f1c2ca5b-6b10-4604-8c74-588878e7d69c

Unit 42 Siloscape Jun 2021

ATTACK:enterprise:G0061 → uses → ATTACK:enterprise:T1134.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f950b817-9082-4299-a310-6b48fc347ebc

Bitdefender FIN8 July 2021 · Symantec FIN8 Jul 2023

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.