Summary

This module is centered on understanding access tokens, and the attacks based on access tokens, such as Access Token Manipulation, Access Token Theft, Token impersonation, etc. Additionally, participants will gain hands-on experience in using WinDbg and other tools to analyze processes, tokens, and security descriptors, and monitoring of WINAPI functions.

This module is broken down into sections with accompanying hands-on exercises to practice each of the techniques we cover. The module ends with a practical hands-on skills assessment to gauge your understanding of the various topic areas.

Introduction
Intro to Toolset
Windows Logon Process
Process Internals and Protection
Understanding Access Tokens
Important Token Structures
Access Checks
Token Privileges
Token Enumeration
Token Manipulation
Token Theft (T1134.001)
Token Impersonation
Make Access Tokens
Network Authentication
PPID Spoofing using Access Token
Detections Opportunities

Students will also gain insight into the inner workings of access tokens, process creation, parent process PID spoofing, and the importance of access control lists (ACLs) and security descriptors in securing system resources. Furthermore, the module covers the techniques used to create new tokens from user credentials, ways to duplicate tokens, creating new processes with stolen tokens, and token impersonation.

There are also some useful scenarios covered in the module, such as the demonstration and detection of token manipulation, escalation to "NT AUTHORITY\SYSTEM", and scenarios demonstrating how kernel drivers detect attacks such as PPID spoofing. As you work through the module, you will see example commands and command output for the various topics introduced. It is worth reproducing as many of these examples as possible to further reinforce the concepts introduced in each section. You can do this in the Pwnbox provided in the interactive sections or on your own virtual machine.

You can start and stop the module at any time and pick up where you left off. There is no time limit or "grading," but you must complete all of the exercises and the skills assessment to receive the maximum number of cubes and have this module marked as complete in any paths you have chosen.

The module is classified as "Hard" because there is a certain requirement for working knowledge of using debuggers, analysis tools, and an understanding of the Windows command line.

A firm grasp of the following modules can be considered a prerequisites for successful completion of this module:

Introduction to Windows Command Line
Introduction to Malware Analysis
Intro to Assembly Language
Basic understanding of C

Introduction

Authentication and authorization are foundational concepts that address two fundamental questions in security:

Authentication (Is the entity who it claims to be?): Authentication ensures that the identity of a user, system, or service is genuine. This verification is typically carried out using methods such as passwords, biometrics, or digital certificates. Authentication acts as the initial checkpoint for establishing trust between entities.
Authorization (What is the entity allowed to do?): Once authentication is successful, authorization defines the scope of actions or resources the entity is permitted to access. It enforces access controls to ensure that users, applications, or systems operate within their designated permissions.

In Windows environments, authentication and authorization are structured around security principals. These principals represent entities capable of initiating actions or requests and include: users, computers, groups and services. To implement authentication and authorization, Windows relies on two key mechanisms, logon sessions and access tokens.

Logon Session: A logon session is created whenever a user successfully signs in to a system. This session uniquely identifies the authenticated user and their session-specific details. For example, when a user logs in, a logon session is established to track their identity and authentication data.
Access Token: After the authentication process, Windows generates an access token, which serves as the security context for the user’s processes and threads. This token contains essential details, such as:
- The user’s unique identifier (SID)
- Membership in security groups
- Assigned privileges
- Integrity levels and associated claims

Access tokens are associated with processes or threads and govern what resources they can access and the actions they can execute. A deeper understanding of tokens is essential for understanding access token manipulation. According to MITRE, Access Token Manipulation (T1134) falls under the Privilege Escalation (TA0004) and Defense Evasion (TA0005) tactics. This involves an adversary manipulating access tokens to bypass access controls and gain unauthorized access to resources within a system or network.

MITRE ATT&CK page on "Access Token Manipulation" describing how adversaries modify access tokens to bypass controls. Includes sub-techniques and methods like token stealing and impersonation.

Access Token Manipulation Techniques

The diagram below shows some common access token manipulation scenarios, which include how an access token is stolen from a target process and how an access token is created using stolen credentials. Once the access token is obtained, it can be used to perform further actions (such as PPID Spoofing (T1134.004)). The access token manipulation techniques shown in the diagram below are:

Token Privilege Modification
Create Process with Token
Token Impersonation

This module presents a comprehensive analysis of access token manipulation techniques used by attackers and provides guidance on detecting these threats.

Access token manipulation is a prevalent strategy used by adversaries to escalate privileges and avoid detection in Windows environments. The MITRE ATT&CK page for Access Token Manipulation (T1134.004) provides detailed information in the Procedure Examples section on how various threat actors execute related techniques.

Table of procedure examples for privilege escalation. Includes entries like AppleSeed using SeDebugPrivilege and AdjustTokenPrivilege, Blue Mockingbird using SeImpersonate, and Duqu starting new processes with stored tokens and copying tokens.

For instance, the screenshot above demonstrates how adversaries manipulate an access token and enable specific privileges, such as SeDebugPrivilege. This privilege allows the debugging or manipulation of processes owned by other users, including those running with elevated privileges.

We can also observe that the AdjustTokenPrivileges() WINAPI function is utilized. This function allows a process to adjust the privileges of an access token. Adversaries can exploit this to enable privileges that are typically disabled (such as SeDebugPrivilege), thereby escalating their privileges to carry out malicious actions.

Table of procedure examples for privilege escalation. HermeticWiper uses AdjustTokenPrivileges for debugging and loading drivers. Mafalda uses AdjustTokenPrivileges to elevate privileges. SUNSPOT modifies tokens for debugging privileges. Other entries include Hydraq, KillDisk, MegaCortex, PoshC2, PowerSploit, Ryuk, Sliver, SslMM.

There are also attempts to escalate privileges to NT Authority\SYSTEM, which is the highest privilege level on a Windows system, equivalent to the root or superuser on Unix-based systems. Adversaries often target this privilege level to gain full control over a compromised system.

$Table showing Blue Mockingbird using JuicyPotato to escalate privileges to NT Authority\SYSTEM. C0017 involves APT41 using BADPOTATO for local NT AUTHORITY\SYSTEM privilege escalation.$

Adversaries have also employed access token manipulation techniques to create new tokens from stolen credentials. They have used impersonation to access resources or perform actions that require higher privileges than those of the current user. This technique involves a thread assuming the identity of another user or security principal, typically to perform actions on their behalf. The screenshot below provides examples of various software/groups that have utilized this technique in real-world attacks.

Table listing Cobalt Strike, FIN13, and Mafalda. Cobalt Strike makes tokens from known credentials. FIN13 uses tools like Incognito V2 for token manipulation and impersonation. Mafalda creates tokens for different users.

API Functions Related to Access Tokens

API functions related to access tokens allow applications to manage and manipulate these tokens, enabling scenarios like impersonation, privilege elevation, and security checks. Some key API functions related to access tokens are categorized as follows:

Token Creation

These functions are used to create or duplicate tokens:

Function Name	Description
`OpenProcessToken`	Opens the access token associated with a process.
`OpenThreadToken`	Opens the access token associated with a thread.
`DuplicateToken`	Duplicates an existing access token, creating a new token with the same properties.
`DuplicateTokenEx`	Duplicates an access token and allows you to specify properties like the desired security level and token type.
`CreateRestrictedToken`	Creates a restricted token by removing privileges or restricting access to specific SIDs.

Token Manipulation

These functions modify or adjust the properties and privileges of tokens:

Function Name	Description
`AdjustTokenPrivileges`	Enables or disables privileges in a token.
`AdjustTokenGroups`	Modifies the group memberships in a token.
`SetTokenInformation`	Changes properties of a token, such as default DACL or session ID.

Token Query

These functions retrieve information about a token:

Function Name	Description
`GetTokenInformation`	Retrieves information about a token, such as privileges, owner, or groups.
`CheckTokenMembership`	Checks whether a token includes a specific SID in its groups.
`IsTokenRestricted`	Determines if a token is a restricted token.

Token Impersonation

These functions allow threads or processes to impersonate other security contexts:

Function Name	Description
`ImpersonateLoggedOnUser`	Allows a thread to impersonate the security context of a logged-on user.
`ImpersonateSelf`	Enables a thread to impersonate itself for certain operations.
`RevertToSelf`	Ends impersonation, reverting the thread back to its original security context.

Miscellaneous

Other important functions related to tokens:

Function Name	Description
`LogonUser`	Authenticates a user and returns a token that represents the user.
`CreateProcessAsUser`	Creates a new process using the security context of a specific token.
`CreateProcessWithTokenW`	Similar to CreateProcessAsUser, but explicitly requires a token handle.
`SetThreadToken`	Assigns a token to a thread for impersonation purposes.

Please refer to this Microsoft documentation to get more details on access tokens and WinAPI functions.

Moving On

To understand access tokens and the attack techniques based on them, we'll go through the fundamental concepts related to processes and tokens, explore different ways to create processes, and then examine the attack scenarios and respective detection opportunities in the following sections. In the upcoming section, we'll cover some basic concepts of WinDbg, debuggers, disassemblers, and other tools used throughout this module.

Sign Up / Log In to Unlock the Module

Please Sign Up or Log In to unlock the module and access the rest of the sections.

Sections

Introduction PREVIEW
Intro to Toolset
Windows Logon Process
Process Internals and Protection
Understanding Access Tokens
Important Token Structures
Access Checks
Token Privileges
Token Enumeration
Token Manipulation
Token Theft (T1134.001)
Token Impersonation
Make Access Tokens
Network Authentication
PPID Spoofing using Access Token
Detections Opportunities
Skills Assessment

Relevant Paths

This module progresses you towards the following Paths

Detection Engineer

The Detection Engineer Job Role Path is designed for security professionals who want to develop the skills required to design, build, validate, and improve enterprise-level security detections. The path aligns with MITRE ATT&CK framework, mapping each technique to a shared vocabulary that links directly to real-world malware, tools, threat groups, mitigations, and detection strategies. This path focuses on understanding adversary behaviors, analyzing security telemetry, and transforming attacker tradecraft into effective detection logic. Through a combination of theoretical concepts and practical exercises, students will explore detection engineering fundamentals, MITRE ATT&CK-based analysis, Windows and Linux telemetry at the user and kernel level, malware behavior, process injection techniques, API monitoring, and low-level operating system visibility. Upon completing this job role path, students will have developed the technical understanding and practical skills required to investigate advanced threats, engineer behavioral detections, and support modern security operations teams. The SOC Analyst Job Role Path can be considered prerequisite knowledge for success while working through this path. A basic understanding of x86/64 Assembly and programming languages such as C or C++ is also strongly recommended to follow this path more easily.

Hard

250 Sections

Required: 12500

Reward: +2500

13 Modules included

Detection & OpSec Cyber Range

Targeted Cyber Ops

Medium

9 Sections

Reward: +100

HTB Academy’s Detection & OpSec Cyber Range is an advanced extension of the purple modules, designed to support both detection engineering and operational security assessment following user-driven attack simulations. It features isolated, fully interactive networks with Windows and Linux purple module targets, generating real-time logs and telemetry, all centrally monitored via Splunk and Wazuh. Built for both blue and red team professionals, the range's reusable infrastructure and pre-installed tooling provide a safe and dedicated environment for identifying post-attack artifacts, developing and validating detections, and evaluating tradecraft exposure, without the need to set up or manage complex, technically demanding infrastructure.

Introduction to Detection Engineering

Medium

29 Sections

Reward: +200 NEW

This HTB Academy module introduces the foundational and advanced concepts required to think and operate like a modern detection engineer. The module explains how attackers operate within Windows environments, how operating system telemetry exposes those behaviors, and how defenders can convert raw telemetry into actionable detections. It contains various hands-on tasks to simulate an attack technique and design detection queries to detect it.

Introduction to Dynamic Analysis with WinDbg

Hard

15 Sections

Reward: +200

This module covers the fundamentals of using the debugger and examines various practical cases where dynamic analysis helps uncover malware TTPs on Windows. It extends to both user-mode and kernel-level debugging, demonstrating how to detect behaviors associated with rootkits or exploits, and how the internal structures of the kernel can reveal the presence of malware.

Process Injection Attacks and Detection

Hard

31 Sections

Reward: +200

This module focuses on understanding the process injection techniques attackers use to execute malicious code within the context of legitimate processes. This detection engineering module covers various injection methods, such as DLL injection, reflective DLL injection, QueueUserAPC, section mapping injection, TLS callbacks, and process hollowing, covering the implementation and detection opportunities of each approach.

Linux Process Injections & Detections

Hard

20 Sections

Reward: +200 NEW

This module introduces various Linux process injection techniques, from basic to advanced ones, from both local and remote standpoints. It focuses on how ELF sections and dynamic-linking structures can be abused for execution flow hijacking and evasion while overriding potential memory protections. It also explores the various detection opportunities and dynamic analysis techniques that can be employed for prevention and mitigation tasks.

Windows Low Level Detectability

Hard

17 Sections

Reward: +200

This module introduces user-mode threat detection on Windows, focusing on low-level techniques and dynamic analysis. It covers the Win32 API, Windows Internals, PE file structures, DLL injection, system call interception, control-flow and kernel return instrumentation, stack trace analysis, and more. It sets a foundation for detecting suspicious memory activity, user-mode evasion methods, and control-flow obfuscation techniques from a programmatic approach.

Detecting Access Token Manipulation Attacks

Hard

17 Sections

Reward: +200

This module focuses on Windows privilege escalation techniques through access token manipulation. It covers various topics, including Windows processes, access tokens, token privileges, and token manipulation. By using tools such as API Monitor, Process Monitor, Sysmon, WinDbg, and disassemblers for analysis, we will investigate the relevant event logs and telemetry generated through Event Tracing for Windows (ETW).

Windows API Monitoring and Hooking

Medium

12 Sections

Reward: +200

This module introduces the monitoring and hooking techniques for Windows APIs. These techniques are used in debugging, reverse engineering, malware analysis, and so on. It covers the Win32 API, Windows Internals, interception, and more. It focuses on how to intercept and monitor API calls made by Windows applications in real-time, helps to understand how a program interacts with the operating system, manipulate or analyze its behavior, and develop tools for analysis.

Privilege Escalation Tradecraft Analysis

Hard

24 Sections

Reward: +200 NEW

This module covers the analytical study of privilege escalation tradecraft on Windows, from its role in the attack lifecycle to how it can be detected and investigated. It focuses on how attackers abuse core Windows mechanisms to escalate privileges and bypass access control. Throughout the module, you will analyze real-world techniques and exploits to understand how they work internally and learn how to translate this knowledge into effective and reliable detection strategies.

Persistence Tradecraft Analysis

Hard

18 Sections

Reward: +200 NEW

This module covers the persistence tradecraft on Windows, from its role in the attack lifecycle to its detection and investigation. Persistence mechanisms allow adversaries to maintain access to compromised systems even after reboots, logoffs, or system interruptions. In Windows environments, attackers often abuse legitimate system features such as Scheduled Tasks, Services, and Registry-based startup mechanisms to ensure their malicious code executes automatically. Understanding how these techniques operate and how they appear in system artifacts is essential for detecting and investigating long-term intrusions. Throughout the module, you will explore real-world persistence mechanisms to understand how they work internally and learn to translate this knowledge into effective, reliable detection rules.

WMI Tradecraft Analysis

Medium

12 Sections

Reward: +200 NEW

This module introduces WMI (Windows Management Instrumentation) based attack and analysis techniques, from both local and remote standpoints. WMI is a core Windows management technology that is frequently abused by attackers for stealthy execution, lateral movement, and persistence. It provides a structured analysis of WMI tradecraft and focuses on how adversaries weaponize WMI and how defenders can detect, hunt, and investigate malicious WMI activity in enterprise environments.

Credential Access Tradecraft Analysis

Hard

21 Sections

Reward: +200 NEW

This module delivers an in-depth, defense-focused study of Windows credential access. It explains how adversaries steal credentials via dumping and abuse of sensitive stores, then breaks down authentication flows, cryptographic protections, and both live-memory and offline extraction to understand tool behavior and build robust detection rules. It also covers DPAPI, Windows Credential Manager, browser credential stores including App-Bound encryption, and Credential Guard bypass techniques with their detection opportunities.

Windows Kernel Telemetry & Detection Techniques

Hard

25 Sections

Reward: +200

This module offers a deep dive into Windows kernel telemetry mechanisms from a defensive security perspective, covering a broad spectrum of telemetry sources exposed by the operating system kernel. It focuses on Event Tracing for Windows (ETW), kernel-mode drivers, and filtering drivers, exploring their roles in monitoring and analyzing system activity. The module includes the design and implementation of detection logic for various TTPs, using a combination of telemetry sources along with documented and undocumented kernel structures, data, and technologies. The module also dives comprehensively into the kernel-level internals of the various concepts that it presents and analyzes real-world use cases to illustrate their practical application in threat detection.