Skip to content
Threat Feed

Tag

Access-Token-Manipulation

2 briefs RSS
medium advisory

Unusual Parent-Child Relationship Detection

This rule identifies Windows programs run from unexpected parent processes, which could indicate masquerading or other strange activity on a system, potentially indicating process injection, masquerading, access token manipulation, or parent PID spoofing.

Microsoft Defender XDR +1 privilege-escalation defense-evasion windows process-injection masquerading access-token-manipulation parent-pid-spoofing
3r 4t
medium advisory

Windows Privilege Escalation via Secondary Logon Service

The rule identifies process creation with alternate credentials, which can be used for privilege escalation, by detecting successful logins via the Secondary Logon service (seclogon) from a local source IP address (::1), followed by process creation using the same TargetLogonId.

Windows privilege-escalation access-token-manipulation
2r 2t