Understanding and Defending Against Access Token Theft: Finding Alternatives to winlogon.exe
specterops.io | blog
Summary
Introduction This blogpost will describe the concept of access token manipulation and how this technique can be utilized against winlogon.exe to impersonate a SYSTEM access token from an administrator context. This technique is mapped to MITRE ATT&CK under Access Token Manipulation. Impersonating a SYSTEM access token is useful in cases that certain privileges have been stripped away from […]
- Published
- Collected
--- id: 9823 title: "Understanding and Defending Against Access Token Theft: Finding Alternatives to winlogon.exe" source_domain: specterops.io source_url: "https://specterops.io/blog/2019/10/01/understanding-and-defending-against-access-token-theft-finding-alternatives-to-winlogon-exe/" published_at: "2019-10-01T15:19:00Z" phying_url: "https://phying.com/item/9823" lang: en --- # Understanding and Defending Against Access Token Theft: Finding Alternatives to winlogon.exe ## Summary Introduction This blogpost will describe the concept of access token manipulation and how this technique can be utilized against winlogon.exe to impersonate a SYSTEM access token from an administrator context. This technique is mapped to MITRE ATT&CK under Access Token Manipulation. Impersonating a SYSTEM access token is useful in cases that certain privileges have been stripped away from […] ## Intelligence Metadata - **Sources:** specterops.io - **Published:** 2019-10-01T15:19:00Z - **Original:** https://specterops.io/blog/2019/10/01/understanding-and-defending-against-access-token-theft-finding-alternatives-to-winlogon-exe/ - **Phying News:** https://phying.com/item/9823