Detecting Access Token Manipulation

## Overview

William Burgess (Security Researcher, Elastic; formerly Endgame and MWR) presented techniques for detecting access token manipulation attacks on Windows domains. The presentation challenges defenders to understand how attackers abuse legitimate Windows functionality—particularly logon sessions and access tokens—to compromise entire domains with minimal initial access (often just phished credentials). The core thesis: attackers exploit Windows trust relationships and single sign-on mechanisms to escalate privileges and move laterally without re-authenticating, making detection difficult for blue teams. Burgess outlines three attack vectors (Pass the Ticket, Pass the Hash, Overpass the Hash) alongside detection methodologies using userland hooks and Windows event telemetry.

## Windows Access Token Architecture and Impersonation Model

**Logon Sessions and Access Tokens**: When a user authenticates (interactive or network), Windows Local Security Authority (LSA) creates two artifacts: a logon session (representing the user's authenticated presence on a machine) and an access token (volatile security context with cached group memberships, privileges, and credentials). Critical design: access tokens are always linked to their originating logon session via an AuthID field; a single logon session may spawn hundreds of tokens, but each token belongs to exactly one logon session. Tokens act as proxies extending the logon session, determining the security context for all access checks.

**Primary vs. Impersonation Tokens**: Every process has a primary access token inherited from its parent; child processes receive local copies of this token. Windows allows thread-level token manipulation via impersonation tokens, where a thread can acquire its own local token copy to slip into a different security context without affecting other threads. This design enables multi-threaded applications to safely handle multiple security contexts simultaneously and allows servers to impersonate remote clients during RPC calls via rpc_impersonate_client API.

**Network Authentication and the Double-Hop Problem**: When accessing domain resources, clients cannot send their local token over the network (it's tied to the originating machine). Instead, clients re-authenticate to the server, creating a new network logon session. Crucially, network logon sessions do NOT cache credentials for further re-authentication, creating the "double-hop problem"—attackers cannot bounce off an intermediate server to a third system without explicit credential forwarding. Windows automatically caches credentials from interactive logons (Kerberos tickets, NTLM hashes) to enable transparent single sign-on, which is both a design feature and exploitation vector.

## Attack Techniques: Pass the Ticket, Pass the Hash, Overpass the Hash

**Pass the Ticket (PTT)**: Attackers extract cached Kerberos tickets from a compromised machine (typically via LSASS process memory) and inject them into a new logon session. Kerberos tickets contain encrypted service authorization data; by replaying a valid ticket, attackers can authenticate to domain services without knowing the original plaintext password. The ticket retains the original user's group memberships and privileges, enabling lateral movement while appearing as the legitimate user.

**Pass the Hash (PtH)**: In NTLM authentication, the server never sees the plaintext password—only an NTLM hash (MD4 of the password). Attackers who obtain the hash can use it directly in NTLM authentication to convince servers of their identity. This works because NTLM authentication is hash-based; the hash itself is the authenticator, not a derivative of it.

**Overpass the Hash**: Attackers use a stolen NTLM hash to request a Kerberos ticket from the Key Distribution Center (KDC). Since Kerberos authentication requires either the plaintext password or NTLM hash, compromising one allows attackers to obtain legitimate Kerberos tickets as if they knew the password. These tickets then enable Pass the Ticket attacks, converting an NTLM credential into a Kerberos credential for broader domain access.

## Detection Methods: Hooks, Telemetry, and Impersonation Monitoring

Burgess's research focused on userland API hooking to intercept token manipulation. Specific detection targets: LSA authentication flows producing new logon sessions (monitoring LogonType fields in Windows Event ID 4624 for suspicious patterns); token duplication and injection (monitoring token operations via Windows Event Tracing for Advanced Logging Policy—WEVT); and impersonation token assignment to threads (capturing rpc_impersonate_client calls and monitoring for unusual security context transitions). Windows native event sources provide coarse telemetry; hooking APIs like LsaLogonUser, DuplicateToken, and SetThreadToken captures fine-grained forensic details. Detection must cross-reference logon session IDs with token operations to identify tokens being passed between unrelated logon sessions, which indicates credential reuse rather than legitimate authentication flows. EDR solutions can implement these hooks to detect pass-the-ticket and overpass-the-hash attacks by monitoring for logon sessions without corresponding interactive authentication events followed by resource access operations.