BINDCLOAK — token duplication + stealthy in-memory DLL load
This rule detects potential token impersonation or duplication events, often used to escalate privileges or move laterally, by monitoring 'TokenDuplication' and 'ImpersonationEvent' actions. It further refines these signals by looking for associated in-memory DLL loads performed by processes other than standard system components (svchost.exe or services.exe).
Microsoft Sentinel (KQL)
