Windows Security: Potential Access Token Abuse via New-Credentials Impersonation

title: "Windows Security: Potential Access Token Abuse via New-Credentials Impersonation"
id: f769fd7f-13f3-4436-b06b-addaa6b382a4
status: test
description: This rule flags Windows Security Event ID 4624 logons using LogonType 9 with the Advapi logon process and Negotiate authentication package, where an impersonation level is indicated. Such activity can reflect access token manipulation that allows an attacker to operate under another security context. The detection relies on telemetry from the Windows Security log, specifically fields present in successful logon events.
references:
  - https://www.elastic.co/fr/blog/how-attackers-abuse-access-token-manipulation
  - https://www.manageengine.com/log-management/cyber-security/access-token-manipulation.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/account_management/win_security_access_token_abuse.yml
author: Michaela Adams, Zach Mathis, Huntrule Team
date: 2022-11-06
modified: 2023-04-26
tags:
  - attack.privilege-escalation
  - attack.stealth
  - attack.t1134.001
  - stp.4u
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID: 4624
    LogonType: 9
    LogonProcessName: Advapi
    AuthenticationPackageName: Negotiate
    ImpersonationLevel: "%%1833"
  condition: selection
falsepositives:
  - Anti-Virus
level: medium
license: DRL-1.1
related:
  - id: 02f7c9c1-1ae8-4c6a-8add-04693807f92f
    type: derived