Token Manipulation Tool Delivered via HTTP

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•6

This rule detects the delivery of a token manipulation tool over HTTP. It specifically looks for the presence of the strings "AdjustTokenPrivileges" and "OpenProcessToken" (case-insensitive) within the file data of an HTTP response. These strings are associated with Windows API calls used for modifying process tokens, which is a common technique for privilege escalation.