Class: RiskTool
Programs in this category have a number of functions (such as concealing files in the system, hiding windows running applications, terminating active processes, etc.) which can be used with malicious intent. They are, in themselves, not malicious. Unlike programs classified as NetTool, RiskTool programs are designed to operate on the local computer. If a user has installed such a program on his/her computer, or if it was installed by a system administrator, then it does not pose any threat.Read more
Platform: Win32
Win32 is an API on Windows NT-based operating systems (Windows XP, Windows 7, etc.) that supports execution of 32-bit applications. One of the most widespread programming platforms in the world.Family: FlyStudio
No family descriptionExamples
EED5C7E8A9C3A300BE1ED4AA1915D65D06AAE0E2F1D3ADBCD5978191B7B1FCB7
33927945F1C29836CA2527032E5B97AE
CFB4933DED04A8996CB68E899E47D8A6
043191D7129EC67462C22C2DA689D4C0
Tactics and Techniques: Mitre*
Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
* © 2025 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation.