Token Impersonation

A series of NTLM reflection and relay attacks that force a privileged process to authenticate to a malicious listener, capturing the token for impersonation.

• Hot Potato: Exploits HTTP-to-SMB NTLM relay and a race condition in the WebDAV redirector.
• Rotten Potato: Abuses the AcceptSecurityContext API to force a SYSTEM-level COM service to authenticate.
• Juicy Potato: A more reliable variant that uses a CLSID lookup to trigger a COM server under SYSTEM context.
• PrintSpoofer: Exploits the RpcRemoteFindFirstPrinterChangeNotification function to force a SYSTEM process to connect to a named pipe.

A technique where an attacker creates a named pipe server and coerces a higher-privileged client to connect to it. The ImpersonateNamedPipeClient API call then allows the server to assume the security context of the connected client.

• The attacker typically uses a printer bug or PetitPotam to force the SYSTEM account to authenticate to the malicious pipe.
• This method is highly effective against unpatched domain controllers and is a core component of many local privilege escalation chains.

Instead of coercing a connection, an attacker with SeDebugPrivilege can directly enumerate and duplicate tokens from running processes.

• Process Hacker / Mimikatz: Tools that use OpenProcessToken and DuplicateTokenEx to create a primary token for spawning a new process.
• Parent PID Spoofing: Combining token duplication with process creation to make a malicious process appear to be a child of a legitimate SYSTEM process.
• This technique requires high initial privileges but provides a direct path to SYSTEM without network coercion.

Many service accounts, such as IIS APPPOOL\DefaultAppPool or NETWORK SERVICE, are granted SeImpersonatePrivilege by default. An attacker who gains code execution in this context can immediately escalate to SYSTEM.

• Web Shell Scenario: A web shell running under the IIS worker process can execute a Potato exploit to gain full system control.
• SQL Server Scenario: An attacker with xp_cmdshell access running as a service account can use token impersonation to break out of the database process isolation.
• This attack vector is a primary reason why service hardening and least-privilege configurations are critical.

A Windows user right that allows a process to impersonate a client after authentication. Originally assigned to services like IIS and SQL Server, this privilege is the core mechanism exploited in token impersonation attacks. When an attacker gains code execution under an account with this right, they can use tools like Juicy Potato, Rogue Potato, or PrintSpoofer to coerce a privileged process into authenticating, then impersonate its token to escalate to NT AUTHORITY\SYSTEM. The privilege is enabled by default for Local Service, Network Service, and members of the Administrators group.

A virtualization-based security (VBS) feature introduced in Windows 10 Enterprise and Windows Server 2016 that isolates user credentials in a protected virtualized environment separate from the operating system. By storing NTLM hashes, Kerberos TGTs, and cleartext credentials in a secure kernel-mode enclave, Credential Guard prevents token impersonation tools like Mimikatz from extracting secrets from LSASS memory. This is a critical defense against both token impersonation and pass-the-hash attacks in agentic systems running on Windows hosts.

A code injection technique where a legitimate process is launched in a suspended state, its memory is unmapped, and replaced with malicious code before resuming execution. This allows malware to execute under the guise of a trusted process, inheriting its security context and evading detection. While distinct from token impersonation, process hollowing achieves a similar goal: executing code in a different security context. Combined with token manipulation, an attacker can hollow a SYSTEM process and inject a payload that runs with elevated privileges. Defenses include memory integrity checks and behavioral EDR monitoring.