Skip to content
Threat Feed

Tag

Token-Impersonation

1 brief RSS
medium advisory

Process Created with a Duplicated Token

This rule identifies the creation of a process impersonating the token of another user logon session on Windows, potentially indicating privilege escalation.

Windows privilege-escalation token-impersonation
2r 2t