Skip to content

Access Token Manipulation

Technique · ATTACK:enterprise:T1134

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:enterprise:T1134",
  "title": "Access Token Manipulation",
  "type": "Technique",
  "source_url": "https://attack.mitre.org/techniques/T1134",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--dcaa092b-7de9-4a21-977f-7fcb77e89c48",
  "external_id": "T1134",
  "domain": "enterprise",
  "created": "2017-12-14T16:46:06.044Z",
  "modified": "2026-05-12T15:12:00.722Z",
  "version": "3.0",
  "aliases": [

  ],
  "tactics": [
    "stealth",
    "privilege-escalation"
  ],
  "source_references": [
    {
      "source_name": "Pentestlab Token Manipulation",
      "url": "https://pentestlab.blog/2017/04/03/token-manipulation/"
    }
  ]
}

Explicit source assertions (30)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:S1242 → uses → ATTACK:enterprise:T1134

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0a068599-574d-4df3-8b05-6194e7366cc4

Picus Qilin MAR 2025

ATTACK:enterprise:S0697 → uses → ATTACK:enterprise:T1134

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2a41b67c-60d5-4784-a5a8-99a60a3f9202

Qualys Hermetic Wiper March 2022 · Crowdstrike DriveSlayer February 2022

ATTACK:enterprise:S0562 → uses → ATTACK:enterprise:T1134

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--339e74c4-5e3a-4272-966f-f5542d255d0a

CrowdStrike SUNSPOT Implant January 2021

ATTACK:enterprise:M1018 → mitigates → ATTACK:enterprise:T1134

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3c5f6c2a-7940-4cdc-8b25-811e33d9b96a

ATTACK:enterprise:G0030 → uses → ATTACK:enterprise:T1134

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4fc87cbb-73ac-448a-9e81-3f2346de0d42

Cisco LotusBlossom 2025

ATTACK:enterprise:S0194 → uses → ATTACK:enterprise:T1134

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--56b59fda-e96d-443d-9f45-e4cc967c911a

GitHub PowerSploit May 2012 · PowerSploit Documentation

ATTACK:enterprise:S0622 → uses → ATTACK:enterprise:T1134

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--57aa85a9-8484-4a1a-947f-3d266d2b3c7d

Malwarebytes Kimsuky June 2021

ATTACK:enterprise:S0633 → uses → ATTACK:enterprise:T1134

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5a25798a-eca1-4841-b422-95aa3bf025e3

Bishop Fox Sliver Framework August 2019 · GitHub Sliver C2

ATTACK:enterprise:T1134.001 → subtechnique-of → ATTACK:enterprise:T1134

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--60d24337-4634-4eef-9d7e-033949228869

ATTACK:enterprise:G0037 → uses → ATTACK:enterprise:T1134

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--671cfed4-4809-4f53-a6b0-ff4da289e406

FireEye FIN6 Apr 2019

ATTACK:enterprise:T1134.004 → subtechnique-of → ATTACK:enterprise:T1134

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6bae365a-4424-4365-a441-dff2b7993250

ATTACK:enterprise:G0108 → uses → ATTACK:enterprise:T1134

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6d3d48ff-ea37-4626-8148-4111163e95e3

RedCanary Mockingbird May 2020

ATTACK:enterprise:S1210 → uses → ATTACK:enterprise:T1134

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8a3ea312-1ae9-4fa0-ba5b-d3b918ff6394

Symantec Bilbug 2022

ATTACK:enterprise:T1134.005 → subtechnique-of → ATTACK:enterprise:T1134

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8bcc4b82-d25f-49ce-a4f2-967994ae21de

ATTACK:enterprise:S0058 → uses → ATTACK:enterprise:T1134

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--93d83b03-8367-4655-84a5-9abaee885700

Baumgartner Naikon 2015

ATTACK:enterprise:S0038 → uses → ATTACK:enterprise:T1134

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--968610c5-7fa5-4840-b9bb-2f70eecd87fa

Kaspersky Duqu 2.0

ATTACK:enterprise:S0363 → uses → ATTACK:enterprise:T1134

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9bd9e08d-efda-4710-8158-9e915dce16d9

Github PowerShell Empire

ATTACK:enterprise:T1134.002 → subtechnique-of → ATTACK:enterprise:T1134

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9f163bcc-193b-49f4-884d-4246dff23e6c

ATTACK:enterprise:M1026 → mitigates → ATTACK:enterprise:T1134

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b82ceba5-d988-472d-acd4-b7b1bc49ebbc

Microsoft Create Token · Microsoft Replace Process Token · Microsoft runas

ATTACK:enterprise:S0666 → uses → ATTACK:enterprise:T1134

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ba218c07-3cde-4555-a150-0c8daff51cee

ESET Gelsemium June 2021

ATTACK:enterprise:S0625 → uses → ATTACK:enterprise:T1134

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c280ba3f-7210-4608-b895-d29932938fe7

McAfee Cuba April 2021

ATTACK:enterprise:S1060 → uses → ATTACK:enterprise:T1134

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c353c2cd-cc78-4d7c-a3b0-5aa1d927368b

SentinelLabs Metador Technical Appendix Sept 2022

ATTACK:enterprise:C0017 → uses → ATTACK:enterprise:T1134

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c372d356-6d5d-4454-b6b4-8297d0da1579

ATTACK:enterprise:T1134.003 → subtechnique-of → ATTACK:enterprise:T1134

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c93ca587-24fe-44d0-951e-30d82b9e6198

ATTACK:enterprise:S0378 → uses → ATTACK:enterprise:T1134

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--cb498ebf-bdb4-476c-9b7a-1a83c19d03fb

ATTACK:enterprise:S0203 → uses → ATTACK:enterprise:T1134

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d68ff9e8-0766-49ea-8ddc-4308347c5bac

Symantec Hydraq Jan 2010

ATTACK:enterprise:S0607 → uses → ATTACK:enterprise:T1134

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d84bda97-a8d5-4886-8172-c5a794b681af

Trend Micro KillDisk 2

ATTACK:enterprise:S0446 → uses → ATTACK:enterprise:T1134

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--fa049cca-da7d-4d89-ac34-cab537ce0235

CrowdStrike Ryuk January 2019

ATTACK:enterprise:S0576 → uses → ATTACK:enterprise:T1134

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--fcfb5392-d5d3-451d-be1f-3cdb5ee264d8

ATTACK:enterprise:S1068 → uses → ATTACK:enterprise:T1134

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--fe3bcb4a-bb14-4068-a9d3-be2f68137f51

Sophos BlackCat Jul 2022 · Microsoft BlackCat Jun 2022

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.