How attackers abuse Access Token Manipulation (ATT&CK T1134)

The blog post examines how attackers exploit Access Token Manipulation (ATT&CK T1134) in Windows environments to compromise Active Directory domains by leveraging the relationship between access tokens, logon sessions, and cached credentials. It explains various techniques attackers use, like stealing or creating new tokens to impersonate users and access network resources without needing to dump credentials, and highlights four common token manipulation attacks: using the NETONLY flag, Pass-The-Ticket, Pass-The-Hash, and Overpass-The-Hash. Each method involves manipulating access tokens or cached credentials to enable lateral movement within a network, often evading detection by security measures through sophisticated means such as using direct syscalls or manipulating security support providers. The blog underscores the importance of understanding these techniques for improving defense mechanisms and detecting unusual network logins or token-related activities, emphasizing the need for holistic security measures like those offered by Elastic Security.

No tracked trend matches for this post yet.

Use this post, company, and trend context to find content marketing opportunities, perform competitive analysis, or address product feature gaps via the Plushcap MCP server or the Plushcap API.