ATT&CK technique
View on MITRE ATT&CK →
T1134.003
Make and Impersonate Token
StealthPrivilege Escalation
6 detections found
Detection rules
| Source | Rule | Status | Updated |
|---|---|---|---|
| elastic | Process Creation via Secondary Logon | production | 2026-10-08 |
| elastic | Interactive Logon by an Unusual Process | production | 2026-09-18 |
| sigma | Potentially Suspicious Explicit Credential Local Logon | experimental | 2026-07-23 |
| sigma | HackTool - Impersonate Execution | test | 2024-11-23 |
| sigma | HackTool - SharpDPAPI Execution | test | 2024-06-26 |
| sigma | HackTool - SharpImpersonation Execution | test | 2023-02-13 |