Windows Tokens

Token and Privilege Enumeration #

Rules cover token and privilege enumeration. [1][5]

• Check Elevated CMD using whoami Splunk

  The following analytic identifies the execution of the "whoami" command with the "/group" flag, where the results are passed to the "find" command in order to look for a the string "12288". This string represents the SID of the group "Mandatory Label\High Mandatory Level" effectively checking if the current process is running as a "High" integrity process or with Administrator privileges. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process and command-line telemetry. This activity is significant because it is commonly used by attackers, such as FIN7, to perform reconnaissance on a compromised host. If confirmed malicious, this behavior could indicate an attacker is assessing their privilege level, potentially leading to further privilege escalation or persistence within the environment.

• Enumerate All Information With Whoami.EXE Sigma

  Detects the execution of "whoami.exe" with the "/all" flag

• Group Membership Reconnaissance Via Whoami.EXE Sigma

  Detects the execution of whoami.exe with the /group command line flag to show group membership for the current user, account type, security identifiers (SID), and attributes.

• HackTool - Impersonate Execution Sigma

  Detects execution of the Impersonate tool. Which can be used to manipulate tokens on a Windows computers remotely (PsExec/WmiExec) or interactively

• Potential WinAPI Calls Via CommandLine Sigma

  Detects the use of WinAPI Functions via the commandline. As seen used by threat actors via the tool winapiexec

• Security Privileges Enumeration Via Whoami.EXE Sigma

  Detects a whoami.exe executed with the /priv command line flag instructing the tool to show all current user privileges. This is often used after a privilege escalation attempt.

• Windows System User Privilege Discovery Splunk

  The following analytic detects the execution of `whoami.exe` with the `/priv` parameter, which displays the privileges assigned to the current user account. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line executions. This activity is significant as it may indicate an adversary attempting to enumerate user privileges, a common step in the reconnaissance phase of an attack. If confirmed malicious, this could lead to privilege escalation or further exploitation within the environment.

Identity and Token Context #

Rules select logon details, effective process identity, or identity and integrity differences between related processes. [1][6]

• Access Token Manipulation via Child Process Elastic

  Adversaries may use access tokens to operate under a different user or system security context to elevate privileges and evade detection. For example, an attacker can create a new process that runs under the security context of another user in order to perform actions they would not normally have privileges for.

• Potential Access Token Abuse Sigma

  Detects potential token impersonation and theft. Example, when using "DuplicateToken(Ex)" and "ImpersonateLoggedOnUser" with the "LOGON32_LOGON_NEW_CREDENTIALS flag".

• RottenPotato Like Attack Pattern Sigma

  Detects logon events that have characteristics of events generated during an attack with RottenPotato and the like

• Suspicious Impersonation as Trusted Installer Elastic

  Identifies actions performed by a process with an impersonation security token running as the Windows Trusted Installer service. Adversaries may need to impersonate this service to modify certain system protected resources.

Token Privilege Adjustment #

Rules cover token privilege adjustments. [1]

• Debug Privilege Enabled by a Low Reputation Process Elastic

  Identifies an unsigned process enabling the SeDebugPrivilege required to debug and adjust the memory of a process owned by another account.

• Potential WinAPI Calls Via CommandLine Sigma

  Detects the use of WinAPI Functions via the commandline. As seen used by threat actors via the tool winapiexec

• Potential WinAPI Calls Via PowerShell Scripts Sigma

  Detects usage of WinAPI functions in PowerShell scripts. It may indicate attempts to perform actions such as process injection, token stealing, or other malicious activities that leverage Windows API calls. These techniques are commonly used to evade traditional file-based detections by loading and executing code directly in memory.

• PowerShell Script with Token Impersonation Capabilities Elastic

  Detects PowerShell scripts that references token manipulation and impersonation APIs such as CreateProcessWithTokenW, DuplicateToken/ImpersonateLoggedOnUser, or AdjustTokenPrivileges (SeDebugPrivilege). Attackers abuse token impersonation to elevate privileges and bypass access controls.

• SeDebugPrivilege Enabled by a Suspicious Process Elastic

  Identifies a process running with a non-SYSTEM account that enables the SeDebugPrivilege privilege. Adversaries may enable this privilege to debug and modify other processes, typically reserved for system-level tasks, to escalate privileges and bypass access controls.

• SeDebugPrivilege Enabled by an Unusual Microsoft Binary Elastic

  Identifies an unusual Microsoft signed process enabling the SeDebugPrivilege required to debug and adjust the memory of a process owned by another account. This could be the result of code injection or process hollowing.

• Windows Access Token Manipulation SeDebugPrivilege Splunk

  The following analytic detects a process enabling the "SeDebugPrivilege" privilege token. It leverages Windows Security Event Logs with EventCode 4703, filtering out common legitimate processes. This activity is significant because SeDebugPrivilege allows a process to inspect and modify the memory of other processes, potentially leading to credential dumping or code injection. If confirmed malicious, an attacker could gain extensive control over system processes, enabling them to escalate privileges, persist in the environment, or access sensitive information.

Duplication and Thread Impersonation References #

Rules cover token duplication and thread impersonation. [1][2][7]

• HackTool - SharpImpersonation Execution Sigma

  Detects execution of the SharpImpersonation tool. Which can be used to manipulate tokens on a Windows computers remotely (PsExec/WmiExec) or interactively

• Malicious PowerShell Commandlets - ProcessCreation Sigma

  Detects Commandlet names from well-known PowerShell exploitation frameworks

• Potential WinAPI Calls Via CommandLine Sigma

  Detects the use of WinAPI Functions via the commandline. As seen used by threat actors via the tool winapiexec

• Potential WinAPI Calls Via PowerShell Scripts Sigma

  Detects usage of WinAPI functions in PowerShell scripts. It may indicate attempts to perform actions such as process injection, token stealing, or other malicious activities that leverage Windows API calls. These techniques are commonly used to evade traditional file-based detections by loading and executing code directly in memory.

• PowerShell Script with Token Impersonation Capabilities Elastic

  Detects PowerShell scripts that references token manipulation and impersonation APIs such as CreateProcessWithTokenW, DuplicateToken/ImpersonateLoggedOnUser, or AdjustTokenPrivileges (SeDebugPrivilege). Attackers abuse token impersonation to elevate privileges and bypass access controls.

Alternate Token Process Context #

Rules select script references or process context associated with creating a process under another token. [8][9]

• HackTool - SharpImpersonation Execution Sigma

  Detects execution of the SharpImpersonation tool. Which can be used to manipulate tokens on a Windows computers remotely (PsExec/WmiExec) or interactively

• Potential Execution via Token Theft Elastic

  Identifies the creation of a process running with a token duplicate and from unbacked memory. Adversaries may create a new process with a different token to escalate privileges and bypass access controls.

• Potential WinAPI Calls Via CommandLine Sigma

  Detects the use of WinAPI Functions via the commandline. As seen used by threat actors via the tool winapiexec

• PowerShell Script with Token Impersonation Capabilities Elastic

  Detects PowerShell scripts that references token manipulation and impersonation APIs such as CreateProcessWithTokenW, DuplicateToken/ImpersonateLoggedOnUser, or AdjustTokenPrivileges (SeDebugPrivilege). Attackers abuse token impersonation to elevate privileges and bypass access controls.

• Process Created with an Elevated Token Elastic

  Identifies the creation of a process running as SYSTEM while impersonating the token context of a Windows core binary. Adversaries may create a new process with a different token to escalate privileges and bypass access controls.

Named Pipe Impersonation Indicators #

Rules select pipe names and shell commands used in impersonation techniques. [2]

• HackTool - CoercedPotato Named Pipe Creation Sigma

  Detects the pattern of a pipe name as used by the hack tool CoercedPotato

• HackTool - DiagTrackEoP Default Named Pipe Sigma

  Detects creation of default named pipe used by the DiagTrackEoP POC, a tool that abuses "SeImpersonate" privilege.

• PowerShell Script with Token Impersonation Capabilities Elastic

  Detects PowerShell scripts that references token manipulation and impersonation APIs such as CreateProcessWithTokenW, DuplicateToken/ImpersonateLoggedOnUser, or AdjustTokenPrivileges (SeDebugPrivilege). Attackers abuse token impersonation to elevate privileges and bypass access controls.

• Privilege Escalation via Named Pipe Impersonation Elastic

  Identifies a privilege escalation attempt via named pipe impersonation. An adversary may abuse this technique by utilizing a framework such as Metasploit's meterpreter getsystem command.

• Privilege Escalation via Named Pipe Impersonation Elastic

  Identifies a privilege escalation attempt via named pipe impersonation. An adversary may abuse this technique by utilizing a framework like Metasploit's getsystem command.

• Privilege Escalation via Rogue Named Pipe Impersonation Elastic

  Identifies a privilege escalation attempt via rogue named pipe impersonation. An adversary may abuse this technique by masquerading as a known named pipe and manipulating a privileged process to connect to it.

Process Access Context #

Rules select process access events using executable names and access masks. [11][12]

• Windows Access Token Manipulation Winlogon Duplicate Token Handle Splunk

  The following analytic detects a process attempting to access winlogon.exe to duplicate its handle. This is identified using Sysmon EventCode 10, focusing on processes targeting winlogon.exe with specific access rights. This activity is significant because it is a common technique used by adversaries to escalate privileges by leveraging the high privileges and security tokens associated with winlogon.exe. If confirmed malicious, this could allow an attacker to gain elevated privileges, potentially leading to full system compromise and unauthorized access to sensitive information.

• Windows Access Token Winlogon Duplicate Handle In Uncommon Path Splunk

  The following analytic detects a process attempting to duplicate the handle of winlogon.exe from an uncommon or public source path. This is identified using Sysmon EventCode 10, focusing on processes targeting winlogon.exe with specific access rights and excluding common system paths. This activity is significant because it may indicate an adversary trying to escalate privileges by leveraging the high-privilege tokens associated with winlogon.exe. If confirmed malicious, this could allow the attacker to gain elevated access, potentially leading to full system compromise and persistent control over the affected host.

• Windows WMI Impersonate Token Splunk

  The following analytic detects potential WMI token impersonation activities in a process or command. It leverages Sysmon EventCode 10 to identify instances where `wmiprvse.exe` has a duplicate handle or full granted access in a target process. This behavior is significant as it is commonly used by malware like Qakbot for privilege escalation or defense evasion. If confirmed malicious, this activity could allow an attacker to gain elevated privileges, evade defenses, and maintain persistence within the environment.

Token Manipulation Tool Indicators #

Rules select tool commands, hashes, process paths, pipe names, and policy names. [13]

• HackTool - Impersonate Execution Sigma

  Detects execution of the Impersonate tool. Which can be used to manipulate tokens on a Windows computers remotely (PsExec/WmiExec) or interactively

• HackTool - Koh Default Named Pipe Sigma

  Detects creation of default named pipes used by the Koh tool

• HackTool - NoFilter Execution Sigma

  Detects execution of NoFilter, a tool for abusing the Windows Filtering Platform for privilege escalation via hardcoded policy name indicators

• Windows Potato Privilege Escalation Tool Execution Splunk

  Detects execution of known Potato-family privilege escalation tools based on original file name, process name, or binary path. A tool class that has been a dominant post-compromise privilege escalation method for over a decade and remains actively used by ransomware operators, red teams, and nation-state actors alike. The Potato family exploits Windows token impersonation and privilege abuse to escalate from a service account, IIS worker process, or other restricted context to SYSTEM. The core abuse chain across most variants involves tricking a SYSTEM-level process into authenticating to an attacker-controlled endpoint, capturing that authentication, and impersonating the resulting SYSTEM token to spawn an elevated process.

Restricted Tokens #

Restricted tokens can limit access to objects and privileged operations. [3]

No reviewed rules currently associated with this section.