Explorer.exe token impersonation via DuplicateTokenEx/ImpersonateLoggedOnUser
Detects potential token impersonation activities where 'DuplicateTokenEx' or 'ImpersonateLoggedOnUser' functions are used in conjunction with 'explorer.exe'. This pattern is often used by adversaries to perform unauthorized privilege escalation or lateral movement by impersonating the security context of a logged-on user.
Microsoft Sentinel (KQL)
