Token Manipulation Tooling for Privilege Escalation (T1134)

Ibrahim Saud@tektrix

•updated 12 days ago•0•0•1

Detects the execution of known privilege escalation tools and the use of specific Windows privilege keywords (such as SeImpersonatePrivilege) often associated with access token manipulation and token impersonation attacks to elevate privileges to SYSTEM.