SPECTRALVIPER XGU Token Theft and Impersonation Framework Activity

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•5

Detects process-related activities involving specific 'XGU::Feature' command line arguments, commonly associated with token manipulation, credential theft, or lateral movement attempts. This rule monitors process creation, cross-process access, and module loading to identify potentially malicious interactions with Windows security tokens.