Skip to content
Threat Feed

Vendor

MILVUS INOVACOES EM SOFTWARE LTDA

1 brief RSS
high advisory

Process Created with an Elevated Token via Token Theft

This rule detects the creation of a process running as SYSTEM while impersonating the token context of a Windows core binary, which adversaries may leverage to escalate privileges and bypass access controls through token theft.

privilege-escalation token-theft windows
2r 1t