Token Privilege Manipulation & Impersonation Indicative of LPE (T1134.001/T1068)

Ibrahim Saud@tektrix

•updated Jun 23, 2026•0•0•3

This rule detects various suspicious activities related to privilege escalation and access token manipulation. It identifies the enablement of sensitive privileges (SeDebugPrivilege, SeTcbPrivilege, SeImpersonatePrivilege) by non-system processes, suspicious API calls for token impersonation/duplication (ImpersonateNamedPipeClient, DuplicateTokenEx) from non-privileged processes, and the creation of SYSTEM child processes by medium-integrity parent processes. These behaviors are often indicative of an attacker attempting to elevate privileges on a compromised system.