---
id: 9823
title: "Understanding and Defending Against Access Token Theft: Finding Alternatives to winlogon.exe"
source_domain: specterops.io
source_url: "https://specterops.io/blog/2019/10/01/understanding-and-defending-against-access-token-theft-finding-alternatives-to-winlogon-exe/"
published_at: "2019-10-01T15:19:00Z"
phying_url: "https://phying.com/item/9823"
lang: en
---

# Understanding and Defending Against Access Token Theft: Finding Alternatives to winlogon.exe

## Summary

Introduction This blogpost will describe the concept of access token manipulation and how this technique can be utilized against winlogon.exe to impersonate a SYSTEM access token from an administrator context. This technique is mapped to MITRE ATT&CK under Access Token Manipulation. Impersonating a SYSTEM access token is useful in cases that certain privileges have been stripped away from […]

## Intelligence Metadata

- **Sources:** specterops.io
- **Published:** 2019-10-01T15:19:00Z
- **Original:** https://specterops.io/blog/2019/10/01/understanding-and-defending-against-access-token-theft-finding-alternatives-to-winlogon-exe/
- **Phying News:** https://phying.com/item/9823