Command line builds a new logon token for impersonation

1title: Command line builds a new logon token for impersonation2id: 7e706190-f71b-4a08-b481-2e8a0d769dc33status: experimental4description: |5  AN1375 is a five-step API/event chain — suspicious command, LogonUser*/6  SetThreadToken API evidence, a 4624 New Logon with no interactive desktop,7  a child process running under the new LogonId, and optional follow-on8  privileged activity — and lib/sigma has no join, so this rule targets only9  step (1), the one link in that chain with a command line: MITRE's own10  example of "runas /netonly" or a "PowerShell P/Invoke of LogonUser". The11  first selection matches runas.exe invoked with /netonly, which creates a12  new logon session for an alternate credential without validating it against13  the domain — the classic CLI proxy for LogonUser-style token creation. The14  second matches a process command line that names both a token-creation API15  (LogonUser or LsaLogonUser) and an impersonation API (SetThreadToken or16  ImpersonateLoggedOnUser) together, the P/Invoke or Add-Type pattern17  offensive PowerShell tooling uses to call both from a single script passed18  inline. Neither selection sees the technique when the actual API calls are19  made in-process by injected or compiled code, or when the PowerShell is20  wrapped in -EncodedCommand, since the base64 blob hides the literal API21  names from CommandLine — that path leaves no command-line evidence at all.22  The brief's second logsource, Security 4672 (Special Privileges Assigned to23  New Logon), is not used: it fires for every logon carrying an24  administrative-equivalent privilege set — built-in admins, most service25  accounts, scheduled tasks, IIS app pools — and it has no process field to26  filter against MITRE's own AllowedImpersonators knob (winlogon.exe,27  lsass.exe, IIS worker, trusted service accounts), since 4672 is a logon28  event, not a process-creation event; without that filter it is far too29  coarse to carry this technique on its own. Prerequisite: 4688-backed30  process creation needs *Audit Process Creation* and the separate *Include31  command line in process creation events* policy, neither on by default.32  UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0498, not hand-written and not tested by its author. Any lab result is on this rule's own page.33references:34  - https://attack.mitre.org/techniques/T1134/00335  - https://attack.mitre.org/detectionstrategies/DET049836author: Siemphony pipeline (machine-derived from MITRE ATT&CK v19.2)37date: 2026-08-1838tags:39  - attack.defense-evasion40  - attack.privilege-escalation41  - attack.t1134.00342logsource:43  category: process_creation44  product: windows45detection:46  selection_runas_netonly:47    Image|endswith: '\runas.exe'48    CommandLine|contains: '/netonly'49  selection_psh_logonuser:50    CommandLine|contains:51      - 'LogonUser'52      - 'LsaLogonUser'53  selection_psh_impersonate:54    CommandLine|contains:55      - 'SetThreadToken'56      - 'ImpersonateLoggedOnUser'57  condition: selection_runas_netonly or (selection_psh_logonuser and selection_psh_impersonate)58falsepositives:59  - "Administrators and help-desk staff running `runas /netonly /user:domain\\admin` by hand to launch a management console with alternate-domain credentials from a workstation that is not joined to, or not currently authenticated to, that domain — a routine, documented workflow."60  - "Jump-box, PAM and credential-vault client tooling that shells out to runas /netonly to pre-load a vaulted alternate credential before launching a remote-administration console, without disabling UAC."61  - "Authorized red-team, purple-team or security-tooling PowerShell modules (e.g. credential-validation or sandboxed-execution test harnesses) that P/Invoke LogonUser together with SetThreadToken or ImpersonateLoggedOnUser as part of their own legitimate function rather than as an attack."62level: medium