TencShell - Token Manipulation Escalation (T1134.002)

Ibrahim Saud@tektrix

•updated Jun 20, 2026•0•0•4

Detects the Go binary executing Windows token manipulation APIs to duplicate tokens and elevate to SYSTEM. Specifically looks for 'setup.exe' performing 'DuplicateTokenExApiCall' or 'SetThreadTokenApiCall'.