TALK: What are you Token' about?
Pavel Yosifovich
ABSTRACT
Access tokens are the beating heart of the Windows security model — carried by every process (and sometimes thread), consulted on every security check, and lurking behind nearly every privilege escalation story. Yet they remain one of the platform's most misunderstood primitives.
In this talk we'll crack open the Windows access token to see what's inside and how it decides what you can and cannot do. We'll trace how tokens are born at logon, how they travel with processes and threads, and how impersonation lets one thread temporarily become someone else.
Then comes the fun part: the same flexibility that makes tokens powerful makes them a gift to attackers. We'll look at how tokens get stolen, duplicated, and impersonated to escalate privileges — and what defenders can watch for.
Whether you build, break, or defend Windows systems, you'll leave with a solid mental model of tokens — and a healthy respect for their power.
Pavel Yosifovich
Pavel Yosifovich is a developer, trainer, and author specializing in Windows internals, system programming, and low-level debugging. He is the co-author of Windows Internals, 7th Edition (Part 1) and has written books on Windows kernel programming and system programming, along with a steady stream of open-source tools that peel back the layers of the OS. A Microsoft MVP and co-founder of TrainSec, he has spent years teaching developers and security researchers how Windows works under the covers. He is currently working at Elastic, focusing on its XDR system.
https://www.linkedin.com/in/pavely
https://x.com/zodiacon
https://trainsec.net
