Brother Industries, Ltd. — CraftedSignal Threat Feedhttps://feed.craftedsignal.io/vendors/brother-industries-ltd./Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioTue, 12 May 2026 19:11:31 +0000Process Created with an Elevated Token via Token Thefthttps://feed.craftedsignal.io/briefs/2026-05-process-created-with-elevated-token/Tue, 12 May 2026 19:11:31 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-05-process-created-with-elevated-token/This rule detects the creation of a process running as SYSTEM while impersonating the token context of a Windows core binary, which adversaries may leverage to escalate privileges and bypass access controls through token theft.This detection rule identifies the creation of a process running as SYSTEM while impersonating the token context of a Windows core binary. The technique, often referred to as token theft, allows adversaries to escalate privileges and bypass access controls by creating a new process with a different token. The rule focuses on detecting instances where a process is initiated with the SYSTEM user ID (S-1-5-18) and its effective parent process is a privileged Microsoft native binary located in a standard Windows directory. This activity is indicative of an attempt to hijack a legitimate system process’s token for malicious purposes. This can lead to full system compromise.

Attack Chain

  1. An attacker gains initial access to the system, potentially through phishing or exploiting a vulnerability.
  2. The attacker identifies a privileged Windows process, such as a service running as SYSTEM, as a target for token theft.
  3. The attacker uses the CreateProcessWithTokenW API (or similar) to create a new process.
  4. The new process is configured to run under the security context (token) of the targeted privileged process.
  5. The attacker then executes malicious code within the context of the newly created process.
  6. This malicious code now operates with SYSTEM-level privileges, bypassing normal access controls.
  7. The attacker can then use these elevated privileges to install malware, modify system settings, or steal sensitive data.
  8. Finally, the adversary achieves persistence and control of the system.

Impact

Successful exploitation allows attackers to perform any action on the system with the highest privileges. This includes installing malware, accessing sensitive data, creating new user accounts with administrative rights, and disabling security controls. The impact is a complete compromise of the affected system. The Elastic rule has a risk score of 73 and is classified as high severity.

Recommendation

  • Enable Elastic Defend to collect the necessary process creation events, as specified in the setup instructions.
  • Deploy the provided Sigma rule to your SIEM to detect processes created with elevated tokens. Tune the rule based on observed false positives in your environment.
  • Investigate any alerts generated by the Sigma rule by examining the process tree, focusing on the user.id, process.executable, process.parent.executable, and process.Ext.effective_parent.executable fields as outlined in the rule’s note section.
  • Review and validate any exceptions before implementing them, ensuring that the exact child/parent/effective-parent pattern is stable for the same host or managed host group, and avoid broad exceptions.
]]>highadvisoryprivilege-escalationtoken-theftwindows