Hello and welcome
to another application
of the minor attack framework
discussion today we're
going to be looking at access,
token manipulation.
So let's go ahead and jump over to
our objectives.
So today's objectives are as
follows.
We're going to describe
access, token manipulation.
We're going to look at how has
access, token manipulation been
used.
We're going to look at what are some
mitigation techniques and then we're
going to look at some detection
techniques as well.
Now, before we jump into the
definition of access token,
just kind of be aware that we're
talking about Windows based
principles with respect to this
token.
And we're not talking about things
like session hijacking or
taking advantage of like websites
and things of that nature to maybe
intercept a user's session
token or doing something of that
nature. This is really based
on the give and definition
when we're talking about it within
the context of the minor
attack framework.
So Windows users tokens to
determine ownership of a
running process.
These access tokens can be
manipulated to appear
as though it belongs to someone
else. And so there are really three
primary methods
in which threat actors can take
advantage of this method.
So you've got token impersonation
or theft.
You've got the ability to create
a process with the token and
then make and impersonate
with respect to using the token.
So let's get into
kind of the how methods in
a short synopsis here.
We're not going to get, again in
detail with how
this works and how you would go
about manipulating these tokens
or impersonating these.
And and that's because
the depth of this course is not for
penetration testing purposes.
It's really for awareness and
kind of understanding the threats
that we're dealing with here.
So, Terk, token
excuse me, token impersonation
or theft is
when a threat actor creates a new
token that duplicates an
existing one. And so commands such
as duplicate token,
impersonate, logged on user
and set red token or just a few
examples of how
a threat could potentially use
some techniques to impersonate
a service or something of that
nature, create processes
with a token. So a threat actor
creates a process with the token
essentially impersonating the
security context of the user.
So if you're a domain administrator,
then I can create a process
using the token that would
impersonate you.
And so that's why when we talk about
these privilege and things of that
nature, we want to ensure
that we're using what is absolutely
necessary to achieve our day to day
tasks. And typically checking email
and doing things of that nature are
not reserved for domain
administrative accounts.
Make an impersonator token so the
threat actor uses
the user's credentials to log
in and create a token
that they can then assign to
a threat, essentially.
So the creation of impersonation
tokens does not require access
to an administrative account.
So take that in mind
that you could have a standard user
account that can do some
impersonations.
And this could be a way that the
threat actor could start to
investigate a system or really
stretch their legs with a user's
account, which is why we
would also want to think about
things such as routine
password policy changes or policy
password policies that we go
that include routine password
changes and things of that nature
said that if credentials are stolen
and a threat actor doesn't
immediately act on those
credentials, there could be
a possibility that the
user's account maybe isn't used
or that this isn't happening
on that account.
So let's talk about just a few
brief mitigation techniques
here so we can limit user
permissions to not allow token
creation. So this can be done
through local system accounts only
using group policy.
You can limit user rights to create
and replace tokens, and then
we can limit user permissions to not
allow for administrative account
use in day to day tasks.
So really
what we're talking about here is,
again, just mitigating factors
on tokens.
If the token is stolen or
I'm sorry if the password or an
account is stolen as far
as the credentials, then
limiting the user's ability to do
these things is one thing, but then
having other controls in place
that would potentially mitigate the
ability of a user
who has had their account
compromised to log in
later. You know, as far as having
that password reset or
having it changed every sixty,
nine hundred and twenty
days, whatever the case may be, can
help to mitigate some risk as well.
So as far as detection techniques
on a command line, activity for
token. Population commands, and so
remember, there are ways that we can
actually pull into
our long congested ingestions
system or just if we're looking to
just flat out generate more data on
command line activity, we can look
for instances of the run
as command and
enable any detailed login
functions. And so sometimes
these things aren't set up right out
of the box or they're not configured
in a way to collect the appropriate
syntax that you would need for
doing some of those defensive
activities or to even get
the types of commands you're looking
for logged.
So just ensure that when you're
sending out these type of functions
to log these types of activities,
that you're going to collect the
ID's or the syntax
of those commands.
It's going to help you to identify
a risk.
So with that in mind, let's go ahead
and do a quick check on learning.
Which of the following is not a
common a common method
for leveraging access tokens?
All right. So if you need additional
time, please
take it now and pause the video so
I can tell you that
we touched on each of these.
So token impersonation
is
valid.
All right. So create
a process with a token is valid and
make and impersonate with a
token is valid.
Token interception
is actually not a common method for
leveraging access tokens.
And so for those of
you that have had experience with
Session Highjacking or you've
watched maybe content on that, you
may have thought or interpreted
that interception of that or maybe
like intercepting a session.
But in this case, we're just talking
about those three methods within
windows.
And so token interception is not
a common method for leveraging
access tokens.
So let's go ahead and step over to
our summary.
So we described access, token
manipulation and that there
were really three primary types of
that. And this is dealing with
windows, tokens.
We described how access, token
manipulation has been used
and can be used.
We describe some mitigation
techniques and we
looked at some detection techniques
as well.
So remember, even though
we didn't touch on at least
privilege always rings true
here, ensuring
that users have
good hygiene as far as cybersecurity
is concerned and that those
practices are being followed
and they're limiting the
ability of a threat actor to really
steal their credentials or
maybe not falling victim to phishing
and things of that nature.
So that all plays a part in this and
protecting against token
manipulation.
So with that in mind, I want to
thank you for your time today, and
I look forward to seeing you again
soon.