Suspicious Token Privilege Modification

Tim Peck@timpeck

•updated Sep 12, 2025•2•1•89

Detects attempts to add sensitive privileges to a process token, a common technique for local privilege escalation. This could be part of an exploit chain following an information disclosure vulnerability like CVE-2025-53136.