← Back to ATT&CK index
T1134.003sub-technique
Make and Impersonate Token
View on attack.mitre.org →3 syscalls implement this technique
- NtDuplicateToken
Creates a new access token that duplicates an existing token, optionally changing its type and impersonation level.
- NtImpersonateThread
Causes the server thread to impersonate the security context of the client thread.
- NtCreateToken
Forges an access token from scratch with caller-specified user, groups, privileges, owner, default DACL and source — gated by SeCreateTokenPrivilege.