Potential Access Token Abuse

SigmaHQ Detections@sigmaHQ

•updated Apr 28, 2026•0•0•0

Detects potential token impersonation and theft. Example, when using "DuplicateToken(Ex)" and "ImpersonateLoggedOnUser" with the "LOGON32_LOGON_NEW_CREDENTIALS flag".