SPECTRALVIPER Token Impersonation via XGU StealToken and Impersonate_ThisThread
This rule monitors process-related logs for specific XGU-prefixed function strings related to access token manipulation and lateral movement, such as token stealing, impersonation, and privilege/UID gathering. The detection looks for these indicators within command line and additional process metadata.
Microsoft Sentinel (KQL)
