Skip to content
Threat Feed

Tag

Token-Manipulation

2 briefs RSS
medium advisory

Unusual Process Performing NewCredentials Logon

Anomalous NewCredentials logon events triggered by uncommon processes may indicate access token manipulation for privilege escalation.

privilege-escalation token-manipulation windows
2r 1t
medium advisory

SeDebugPrivilege Enabled by a Suspicious Process

The rule identifies a process running with a non-SYSTEM account that enables the SeDebugPrivilege privilege, which can be used by adversaries to debug and modify other processes to escalate privileges and bypass access controls.

Windows privilege-escalation token-manipulation
2r 1t