Which technique involves manipulating access tokens to impersonate other users and escalate privileges?

Which technique involves manipulating access tokens to impersonate other users and escalate privileges?

• A. Application Shimming
• B. Shims
• C. Access Token Manipulation
• D. Runas

Answer: (C)

Access tokens are the security identity for a running process. They determine who the user is, what groups they belong to, and what privileges they have. Manipulating these tokens means changing the security context under which a process or thread runs, so an attacker can impersonate another user and gain that user’s privileges. By altering or duplicating a token, or making a thread execute with a different token, the attacker effectively runs with higher or different rights, enabling privilege escalation and access to resources that should be restricted. This direct control over the process’s security context is what makes access token manipulation the technique described. Other methods described by different names involve starting new processes under another user or altering software behavior in ways that don’t rely on changing the token itself, so they don’t capture the same mechanism of impersonation through the token.

Access tokens are the security identity for a running process. They determine who the user is, what groups they belong to, and what privileges they have. Manipulating these tokens means changing the security context under which a process or thread runs, so an attacker can impersonate another user and gain that user’s privileges. By altering or duplicating a token, or making a thread execute with a different token, the attacker effectively runs with higher or different rights, enabling privilege escalation and access to resources that should be restricted. This direct control over the process’s security context is what makes access token manipulation the technique described. Other methods described by different names involve starting new processes under another user or altering software behavior in ways that don’t rely on changing the token itself, so they don’t capture the same mechanism of impersonation through the token.