Skip to content
Threat Feed
Subscribe

Vendor

Chocolatey Software, Inc

2 briefs RSS
high advisory

Process Created with an Elevated Token via Token Theft

This rule detects the creation of a process running as SYSTEM while impersonating the token context of a Windows core binary, which adversaries may leverage to escalate privileges and bypass access controls through token theft.

privilege-escalation token-theft windows
2r 1t
medium advisory

Suspicious PowerShell Engine ImageLoad

This rule identifies instances where the PowerShell engine is loaded by processes other than powershell.exe, potentially indicating attackers attempting to use PowerShell functionality stealthily by using the underlying System.Management.Automation namespace and bypassing PowerShell security features.

Elastic Defend powershell execution windows
2r 1t