Skip to content

Rarity of High-Privilege Process Execution

What it detects

Find processes running under a user, token, or privilege context that is rare for that executable. This is useful when a process that normally runs at user level suddenly executes as Administrator or SYSTEM. Model this as an authority transition: the actor or process acquires more authority than expected for its prior context.1

Process and context Interpretation
chrome.exe → standard user Common
backupagent.exe → SYSTEM Expected if established by baseline
winword.exe → SYSTEM Potentially unusual

Treat rarity as a hunting lead, not proof of compromise.

Telemetry and fields

Use process-creation or equivalent EDR telemetry with:

  • Timestamp and host
  • Process name and full path
  • Process hash and signer, where available
  • User and SID/token identity
  • Integrity level
  • Elevation status or token type
  • Parent process and parent user
  • Process GUID or another stable process identifier

Implementation

  1. Group historical process executions by process + path + user/token + integrity/elevation.
  2. Calculate frequency, prevalence across hosts, and first/last seen values.
  3. Compare the current combination with its history and, where appropriate, similar hosts.
  4. Surface rare, previously unseen, or unexpectedly elevated combinations.

Possible implementations include SIEM statistics or rarity functions, historical lookups, EDR analytics, and ML rarity models.

Use three complementary views rather than one score:

View Question
Privileged-process rarity Is this executable rarely observed under this user, token owner, host, or integrity level?
Privileged-action population Is this user performing administrative actions absent from comparable users?
Elevation burst or ratio Did elevated_child_count / total_child_count or another privileged-action rate change sharply? 
process + execution identity + privilege
  → historical frequency
  → rare or first-seen combination

Token-abuse sequence

Where API or equivalent EDR telemetry is available, correlate an unusual low-privilege caller with the ordered token workflow described in the source:2

OpenProcess against a privileged process
  → OpenProcessToken
  → DuplicateTokenEx
  → SetThreadToken / CreateProcessAsUser / CreateProcessWithTokenW
  → child or thread executes under the acquired identity

If the sequence is unavailable, retain evidence that supports an inference:

  • Parent and child user SIDs or normalized token owners
  • Parent and child integrity levels
  • Explicit-credential logon or administrative-consent evidence
  • Service-start and scheduled-task context
  • SeDebugPrivilege or related privilege adjustment
  • A low- or medium-integrity parent followed by a high-integrity or SYSTEM child

A parent-child token mismatch without a corresponding administrative workflow is stronger than process rarity alone. Preserve stable process identifiers so token and process events can be joined despite PID reuse.

Interesting results

Prioritize:

  • A user-level application executing as Administrator or SYSTEM
  • A rare process-path and privileged-token combination
  • A process running under a privileged account for the first time
  • An unusual parent launching a high-integrity child
  • A rare privileged execution followed by credential access, persistence, injection, or network activity

Key question: Is this privilege context normal for this exact executable, path, parent, user, and host role?

  1. Gianluca Tiepolo and Dan Sorensen, Advanced Cyber Threat Intelligence and Hunting, first edition, Packt, 2026, Chapter 6, "Privilege escalation and token abuse," supplied EPUB extraction lines 393–415. ↩

  2. Tiepolo and Sorensen, Chapter 10, "Token Impersonation/Theft" and "Detection opportunities," supplied EPUB extraction lines 650–714. ↩