Token Impersonation via ImpersonateLoggedOnUser

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•6

This rule detects attempts at token impersonation by looking for the strings "ImpersonateLoggedOnUser" and "DuplicateTokenEx" within HTTP response bodies. This technique is often used by attackers to elevate privileges by impersonating a logged-on user's security token.