Threat Hunting Exercise: Analyzing Windows Token Impersonation SeDebugPrivilege Dataset
This hunt uses a simulated endpoint telemetry dataset (win_sysmon_token_impersonation_2022-09-14T110000.json) capturing T1134.001: Access Token Manipulation (Token Impersonation/Theft), where an attacker enables SeDebugPrivilege on a low-privilege process, opens a handle to a SYSTEM-level process, and duplicates its token to escalate privileges without touching LSASS credentials directly.
Step 1: Hypothesis Formation
Hypothesis: A non-administrative process opens a handle to a SYSTEM process (e.g., winlogon.exe, lsass.exe, services.exe) with an access mask indicating PROCESS_QUERY_INFORMATION | PROCESS_DUP_HANDLE, immediately followed by that process spawning a child with a SYSTEM-level token - indicating token duplication/impersonation for privilege escalation. Indicators:
- Sysmon Event ID 10 (ProcessAccess) targeting a SYSTEM process from a process running under a standard user token.
- The requesting process previously enabled
SeDebugPrivilege(visible in Event ID 4703, "A token right was adjusted"). - A subsequent child process created by the requesting process runs as
NT AUTHORITY\SYSTEMdespite the parent running as a standard user. - The requesting binary is unsigned or located in a non-standard path (e.g., user temp directories).
Null Hypothesis: A legitimate EDR agent or system-management tool (which routinely requires SeDebugPrivilege for its own monitoring functions) is responsible for the process access. Invalidate by checking the binary against the approved security-tooling inventory and code-signing certificate.
Rationale: Token impersonation avoids classic LSASS memory-dump detections entirely, since no credential material is extracted - only a token handle is duplicated - making this a stealthy, high-value privilege-escalation technique that requires access-token-specific detection logic.
Step 2: Data Sources and Scope
- Sources: Sysmon Event ID 1, 10 (ProcessAccess), and Windows Security Event ID 4703 (token right adjusted), 4688; EDR privilege-escalation telemetry.
- Scope: ~2022-09-14T11:00:00-11:10:00 UTC; Host: WKS-DEV-033 (10.50.8.19); User:
contractor_j. - SIEM Queries (Splunk/ELK):
index=sysmon EventCode=10 TargetImage IN ("winlogon.exe","services.exe","*lsass.exe") GrantedAccess="0x1410"- Privilege adjustment:
index=wineventlog EventCode=4703 Privilege_List="SeDebugPrivilege" - SYSTEM child spawn:
index=sysmon EventCode=1 ParentUser!="SYSTEM" User="NT AUTHORITY\\SYSTEM"
Step 3: Key Findings
Parsed events (5 shown) confirm a process running under contractor_j's standard token enabled SeDebugPrivilege, opened a handle to winlogon.exe, and spawned a SYSTEM-level cmd.exe - a complete token-impersonation privilege escalation.
| Timestamp (UTC) | Host | Event | Detail | IOC/Why Suspicious? |
|---|---|---|---|---|
| 2022-09-14 11:03:02 | WKS-DEV-033 | 4703 (Token Right Adjusted) | Process updater.exe (PID 5588, user contractor_j) enabled SeDebugPrivilege | Precursor IOC: standard users are not granted SeDebugPrivilege by default; explicit enabling by a non-admin process is a strong escalation-preparation signal. |
| 2022-09-14 11:03:04 | WKS-DEV-033 | Sysmon Event ID 10 | updater.exe opened winlogon.exe with GrantedAccess: 0x1410 (QUERY_INFORMATION + DUP_HANDLE) | Token-Theft IOC: this exact access mask is the signature footprint of token duplication tooling (e.g., Incognito, custom C# loaders). |
| 2022-09-14 11:03:06 | WKS-DEV-033 | Sysmon Event ID 1 | updater.exe spawned cmd.exe running as NT AUTHORITY\SYSTEM | Privilege-Escalation IOC: a child process inheriting a SYSTEM token from a parent that itself ran as a standard user is direct proof of successful impersonation. |
| 2022-09-14 11:03:41 | WKS-DEV-033 | Sysmon Event ID 1 | SYSTEM cmd.exe executed net user backdoor_svc P@ssw0rd123! /add and net localgroup administrators backdoor_svc /add | Persistence IOC: the escalated SYSTEM shell was immediately used to create a new local administrator account for durable access. |
| - | WKS-DEV-033 | (binary provenance check) | updater.exe is unsigned, located at C:\Users\contractor_j\AppData\Local\Temp\updater.exe, not present in the software inventory | Confirms the binary is not a legitimate application updater and has no approved deployment record. |
Validation:
- Timeline: privilege enablement → SYSTEM process handle access → token duplication → SYSTEM shell → local admin backdoor creation, all within 40 seconds - a complete and rapid escalation chain.
- False Positives: the binary does not match any known EDR/management agent signature or path, and no corresponding software deployment record exists.
- Correlation: privilege adjustment, precise access mask, SYSTEM-token child process, and immediate backdoor account creation jointly confirm malicious token impersonation.
Step 4: Recommendations & Next Steps
- Immediate Response: Isolate WKS-DEV-033, disable and investigate the
backdoor_svcaccount domain-wide (check for lateral use), terminate theupdater.exe/cmd.exeprocess tree, and reviewcontractor_j's access scope and offboarding status. - Detection: Sigma-style rule:
title: SYSTEM Token Impersonation via Process Handle Duplication→selection: EventID=10 AND TargetImage IN ('winlogon.exe','lsass.exe','*services.exe') AND GrantedAccess='0x1410' AND SourceUser NOT IN ('SYSTEM','LOCAL SERVICE')→condition: selection. - Pro Tip: Alert specifically on the sequence of 4703 (SeDebugPrivilege enabled by a non-admin) followed within 60 seconds by a Sysmon 10 ProcessAccess to a SYSTEM process - either event alone is noisy, but the pairing is a near-unique fingerprint of token-theft tooling.
Hypothesis confirmed - a contractor workstation ran an unsigned binary that enabled SeDebugPrivilege, duplicated a SYSTEM token from winlogon.exe, and used the resulting SYSTEM shell to plant a new local administrator backdoor account!