StrikeShark Token Impersonation - SYSTEM Child from Unusual Parent Process

Ibrahim Saud@tektrix

•updated Jun 28, 2026•0•0•1

Detects a process running at SYSTEM integrity level spawned by a parent process that is not typically associated with SYSTEM-level process creation (e.g., services.exe, lsass.exe). This behavior is characteristic of token impersonation or process spawning abuse (e.g., CreateProcessWithTokenW) used by post-exploitation frameworks like Cobalt Strike or tools involved in the StrikeShark campaign to escalate privileges.