Cobalt Strike Token Impersonation via ImpersonateLoggedOnUser or DuplicateTokenEx

Ibrahim Saud@tektrix

•updated Jun 28, 2026•1•0•7

This rule detects token manipulation and impersonation behaviors characteristic of Cobalt Strike post-exploitation activity. It specifically identifies instances where common child processes (cmd.exe, powershell.exe, net.exe, whoami.exe) are spawned from non-standard parent processes associated with Cobalt Strike payloads (e.g., rundll32.exe, msiexec.exe, svchost.exe), often accompanied by a discrepancy between the effective username and the parent process username or the use of discovery tools post-impersonation.