Executive Summary
Microsoft has enhanced its Defender for Endpoint telemetry by exposing specific privileged security identifier (SID) context within Windows access tokens at the moment of logon. Historically, while logon events were captured, the internal privilege context—such as membership in high-value groups like Domain Admins—was not directly queryable in Advanced Hunting. This new telemetry closes that gap by deriving specific fields from the Local Security Authority (LSA) token creation events.
This update is technically significant because it captures the security context at the point of token construction. This allows defenders to identify 'ephemeral' privilege elevation, where an attacker might temporarily join a privileged group or use direct PAC manipulation (e.g., Golden or Silver Tickets) that would not be reflected in standard Active Directory logs if the membership is quickly reverted. For organizations, this provides high-fidelity visibility into lateral movement and unauthorized privilege escalation that previously required complex manual correlation.