How do you detect token impersonation?

Detect token impersonation from three angles. In Security logs, watch for logon type 9 with the Advapi logon process (runas /netonly and make_token), Event 4703 showing SeDebug, SeImpersonate or SeAssignPrimaryToken being enabled in unusual processes, and new accounts appearing in 4672 special-privilege events. In Sysmon, look for Event 10 process access to winlogon.exe or services.exe with a 0x1400 access mask from non-system paths. Finally, alert on SYSTEM-owned children whose parent runs as a lower-privilege user. Allowlist security agents, which touch these processes legitimately.

Detecting Token Impersonation: SeImpersonate, Logon Type 9 and Token Theft

Access token manipulation lets a process act as another user without knowing that user’s password. Attackers duplicate a token from a more privileged process (T1134.001), start a process with it (T1134.002), or build a new one with stolen credentials (T1134.003). Each path needs particular privileges and API calls, and those leave telemetry.

Signals at a Glance

Signal	Where	ATT&CK
Logon type 9 (NewCredentials) with logon process Advapi	Security 4624	T1134.003
SeDebug, SeImpersonate, SeAssignPrimaryToken or SeTcb enabled in a non-system process	Security 4703	T1134
User-mode process opening winlogon or services with access mask 0x1400	Sysmon 10	T1134.001
SYSTEM-owned child whose parent runs as a lower-privilege user	Sysmon 1, EDR	T1134.002
Special privileges assigned (4672) to an account that never holds them	Security 4672	T1134

Logon and Privilege Events

Make-token style tradecraft, including runas /netonly and Cobalt Strike’s make_token, produces a type 9 logon with the Advapi logon process. Administrators use it legitimately, so look for rare source accounts and unusual host processes rather than the event alone:

index=wineventlog source="WinEventLog:Security" EventCode=4624 Logon_Type=9
| search Logon_Process=Advapi
| stats count min(_time) as first max(_time) as last
        values(Process_Name) as procs by host, Account_Name, Source_Network_Address
| sort - count
```tune/validate: field names depend on your Windows TA; add a rarity filter on Account_Name```

Event 4703 records privileges being enabled in a token. Token theft needs SeDebug or SeImpersonate to be switched on first, so a process outside the usual set of enablers is a lead:

// Microsoft Sentinel (KQL) - sensitive token privileges enabled
SecurityEvent
| where EventID == 4703
| where EnabledPrivilegeList has_any ("SeDebugPrivilege","SeImpersonatePrivilege","SeAssignPrimaryTokenPrivilege","SeTcbPrivilege")
| where ProcessName !has_any ("lsass.exe","svchost.exe","services.exe","MsMpEng.exe")
| summarize hits=count() by Computer, SubjectUserName, ProcessName, bin(TimeGenerated, 1h)
// tune/validate: EDR and backup agents enable these routinely; build an allowlist by ProcessName.

Theft from Other Processes

Duplicating a token means opening a handle to a privileged process. Sysmon Event ID 10 shows the source image, the target and the granted access. A query-only access mask of 0x1400 against winlogon.exe or services.exe from a user-writable path is a strong lead:

title: Token Access to SYSTEM Process from Unusual Source
logsource:
  product: windows
  category: process_access
detection:
  selection:
    TargetImage|endswith:
      - '\winlogon.exe'
      - '\services.exe'
    GrantedAccess: '0x1400'
  filter_system:
    SourceImage|startswith:
      - 'C:\Windows\System32\'
      - 'C:\Program Files\'
  condition: selection and not filter_system
level: medium
# tune/validate: security products open these processes constantly; allowlist by signed path.

Baseline which accounts normally appear in 4672 events, then alert on new ones. Service accounts that suddenly show administrative privileges are interesting.
Pair token events with process lineage: a SYSTEM-owned shell with a non-SYSTEM parent is the outcome the other signals predict.
Treat type 9 logons as correlation material; on their own they are common in administrator workflows.

Vetted sources

Use SigmaHQ process-access and logon rules, Elastic’s prebuilt rules for token manipulation, MITRE CAR analytics for privilege use, and Atomic Red Team T1134 tests for validation. Baseline your own environment — endpoint security software enables these privileges as part of normal operation.

Build Detections That Fire

Mjolnir Security helps blue teams turn threat intelligence into high-fidelity detections across endpoint, network, identity and cloud telemetry.

Detection EngineeringManaged Detection & ResponseThreat HuntingIncident ResponsePurple Teaming

Detection Engineering We build and tune detections mapped to ATT&CK from your own telemetry.
Threat Hunting as a Service Hypothesis-driven hunts for the behaviours on this page.
24/7 Incident Response Containment when a detection fires. Call +1 833 403 5875.

Written by: Mjolnir Threat Research (MTAC)  |  Published: October 12, 2026  |  Last reviewed: October 12, 2026

Signals at a Glance

Logon and Privilege Events

Theft from Other Processes

Build Detections That Fire

Privilege Escalation Detection

Detection Hub

Potato Attack Detection