Process Creation via Secondary Logon

Last updated 2 months ago on 2025-11-14

Created 3 years ago on 2022-08-30

About

Identifies process creation with alternate credentials. Adversaries may create a new process with a different token to escalate privileges and bypass access controls.

Tags

Domain: EndpointOS: WindowsUse Case: Threat DetectionTactic: Privilege EscalationData Source: Windows Security Event LogsLanguage: eql

Severity

medium

Risk Score

MITRE ATT&CK™

Privilege Escalation (TA0004)(external, opens in a new tab or window)

↳ Access Token Manipulation (T1134)(external, opens in a new tab or window)

License

Elastic License v2(external, opens in a new tab or window)

Definition

Rule Type

Event Correlation Rule

Integration Pack

Prebuilt Security Detection Rules

Index Patterns

logs-system.security*logs-windows.forwarded*winlogbeat-*

Related Integrations

system(external, opens in a new tab or window)

windows(external, opens in a new tab or window)

Query

✄𐘗text code block:
✄𐘗sequence by winlog.computer_name with maxspan=1m

[authentication where host.os.type == "windows" and event.action:"logged-in" and
 event.outcome == "success" and user.id : ("S-1-5-21-*", "S-1-12-1-*") and

 /* seclogon service */
 process.name == "svchost.exe" and
 winlog.event_data.LogonProcessName : "seclogo*" and source.ip == "::1" ] by winlog.event_data.TargetLogonId

[process where host.os.type == "windows" and event.type == "start"] by winlog.event_data.TargetLogonId

Install detection rules in Elastic Security

Detect Process Creation via Secondary Logon in the Elastic Security detection engine by installing this rule into your Elastic Stack.

To setup this rule, check out the installation guide for Prebuilt Security Detection Rules(external, opens in a new tab or window).