APT - Threat Hunt: Access Token Manipulation
Detects potential token theft, impersonation, or privilege escalation activity in Windows environments by monitoring ProcessPrimaryTokenModified events. This query highlights suspicious changes in SIDs, token sources, integrity levels, or privilege flags, including attempts to impersonate SYSTEM or add high-risk privileges (SeDebugPrivilege, SeImpersonatePrivilege). Such behavior is strongly associated with lateral movement and privilege escalation techniques used by APTs, ransomware operators, and red team tooling like Mimikatz and Cobalt Strike.
Microsoft Sentinel (KQL)
