T1134.001

Official Description

Adversaries may duplicate then impersonate another user's existing token to escalate privileges and bypass access controls. For example, an adversary can duplicate an existing token using `DuplicateToken` or `DuplicateTokenEx`.(Citation: DuplicateToken function) The token can then be used with `ImpersonateLoggedOnUser` to allow the calling thread to impersonate a logged on user's security context, or with `SetThreadToken` to assign the impersonated token to a thread.

An adversary may perform [Token Impersonation/Theft](https://attack.mitre.org/techniques/T1134/001) when they have a specific, existing process they want to assign the duplicated token to. For example, this may be useful for when the target user has a non-network logon session on the system.

When an adversary would instead use a duplicated token to create a new process rather than attaching to an existing process, they can additionally [Create Process with Token](https://attack.mitre.org/techniques/T1134/002) using `CreateProcessWithTokenW` or `CreateProcessAsUserW`. [Token Impersonation/Theft](https://attack.mitre.org/techniques/T1134/001) is also distinct from [Make and Impersonate Token](https://attack.mitre.org/techniques/T1134/003) in that it refers to duplicating an existing token, rather than creating a new one.

Tactics: Stealth, Privilege Escalation
Platforms: Windows
Parent Technique: T1134 · Access Token Manipulation
MITRE Version: 2.0
Last Modified: May 12, 2026

View on MITRE ATT&CK ↗

Reported Context (2)

Threat actors duplicated the token of a process running under a domain-privileged service account. PaperCut Zero-Days Used to Deploy AdaptixC2 and Compromise an Education Customer’s Domain
When not already running as SYSTEM, the loader accessed the winlogon.exe SYSTEM token for impersonation. Cambodia-Focused Malware Campaign Uses Multi-Stage Infection Chain and SparkRAT

CVE (3)

Malware (2)

Threat Actors (1)

MITRE ATT&CK (27)

Vendors (6)

Products (10)

Tools (8)

Industries (1)

Countries (1)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.