Token and Privileges

Inside a Process

Every process carries an access token, which names the account it runs as, the groups that account belongs to, its privileges and its integrity level. Windows checks the token whenever the process opens a file, a key or another process, so it decides what the process can reach. Core processes and many services run as SYSTEM, and a person's programs run as that person at medium integrity, or high once an elevation is approved. An account that does not fit the process, or system integrity in a program a person runs, is the lead, so read the user and the integrity level first.

What It Is

A token is the ID badge Windows gives a process. It names the account the process works for, the groups that account belongs to, and the privileges it holds.

Why Windows Needs It
Every time a process opens a file, a key or another process, Windows has to decide whether it may. It reads the badge, so it never has to ask for a password again.
An Everyday Example
When alice signs in, Windows checks her password once and makes her token. Every program she starts, Notepad included, gets a copy, so Notepad can open alice's own files but not change Windows' own files in System32.
The token notepad.exe carries when alice starts it

notepad.exe, started by alice

User
aliceThe account it works for, named by its SID
Groups
Users, Everyone and othersEach group adds what its members may open
Integrity
MediumA level that limits what it may change
Privileges
A few, most switched offRights to system tasks, such as shutting the machine down
Elevation
Default (Type 1)Not elevated. Full (Type 2) means elevated, after an administrator approved a User Account Control (UAC) prompt
Kept by the Kernel
The kernel keeps each process's primary token, and any token a thread holds while it impersonates a client.

Reading a SID

A SID names an account or a group. Its last number, the relative identifier, picks out the account, and the numbers before it name the domain or the computer that issued it.

A local account's SID is written here with its middle left out, as S-1-5-21-...-1001. Built-in groups use the domain number 32, so Administrators is always S-1-5-32-544, while each computer's own Administrator account ends in 500.

S-1-5-21-...-500, part by part
  1. SSID
  2. 1Revision level
  3. 5Identifier authority
  4. 21-...Domain or computer
  5. 500Relative identifier

The SIDs a token shows most

SIDNameWhere You See It
S-1-5-18SYSTEMCore processes and many services
S-1-5-19LOCAL SERVICEServices that need few rights
S-1-5-20NETWORK SERVICEServices that reach the network as the computer
S-1-5-32-544AdministratorsAdministrators and SYSTEM
S-1-5-21-...-500The computer's or domain's Administrator accountA built-in administrator
S-1-16-8192Medium integrityA person's programs
S-1-16-12288High integrityAn elevated program
S-1-16-16384System integrityServices and core processes

Privileges

A privilege lets an account do a system task, such as backing up files or debugging. SeDebugPrivilege lets its holder open and change the memory of any process, whatever that process's permissions say. LSA protection is the exception, which runs lsass.exe as a protected process that other programs cannot read or change.

Each privilege in a token is present, and may also be enabled. windows.privileges prints the attributes, so read Enabled before treating a privilege as used.

Services the Service Control Manager starts hold SeImpersonatePrivilege as part of their job, so its presence in a service is normal.

Impersonation

A thread can work under another account's token while its process keeps its own. Servers do this to act for a client, at one of four levels from anonymous to delegation.

Windows.Detection.Impersonation lists threads whose token differs from their process's. A service that impersonates its clients is normal, while a person's program impersonating SYSTEM is the lead.

What Normal Looks Like

On a healthy machine this part looks like this.

  • Core Windows processes and many services run as SYSTEM (S-1-5-18), and others run as LOCAL SERVICE (S-1-5-19) or NETWORK SERVICE (S-1-5-20).
  • A person's programs run as that person at medium integrity, and at high only after an approved elevation.
  • An administrator's ordinary programs run with the standard token, and the administrator token is used only once an elevation is approved.
  • SYSTEM is a hidden member of Administrators, so every process running as SYSTEM carries the Administrators SID.
  • A privilege can be present in a token and not enabled. Administrators hold SeDebugPrivilege, but it is off until a program turns it on.

Why It Matters

The token decides what a process may open and change. A prompt running as SYSTEM that no person opened, or a privilege switched on where nothing needs it, points to someone working with more rights than they should have.

Normal and Suspicious

A clean machine sits beside a suspicious one, and the pointer marks where to look.

Normal

A clean Windows 11 install

A command prompt a standard user opened on a clean install, not elevated.
PartValue
IntegrityMedium (S-1-16-8192)
Elevation typeDefault (Type 1)
UserThe person signed in
See It in the Window

Suspicious

ws-042,

cmd.exe under PSEXESVC.exe on ws-042 at 10:08 on 12 Oct 2026, session 0.
PartValue
IntegritySystem (S-1-16-16384)
Elevation typeDefault (Type 1)
UserNT AUTHORITY\SYSTEM (S-1-5-18)
ValueSYSTEM in a command prompt: a prompt a person opens runs as that person, not the machine account. Wrong Account
See It in the Window

What a Malicious Example Shows

Each card is what malicious use of this part looks like, and where it shows.

  • A process running as another account than its parent, with no logon or service to explain it.Where it shows: windows.getsids or Windows.System.Pslist against the parent, or the Target Subject of event 4688 in the Security log against its Creator Subject.
  • A thread inside a person's program working under SYSTEM's or another account's token.Where it shows: Windows.Detection.Impersonation lists threads whose token differs from their process's.
  • A token for a new logon with someone else's credentials, used by a process on this machine.Where it shows: A new logon session in the token, and events 4624 and 4648 in the machine's Security log.
  • SeDebugPrivilege enabled in a program that is not a debugger or admin tool, beside a handle to lsass.exe.Where it shows: windows.privileges showing Present,Enabled, event 4703 in the Security log, or OpenProcessApiCall on lsass.exe in DeviceEvents.
  • A high integrity process whose parent ran at medium integrity, with no elevation the person approved.Where it shows: Event 4688 in the Security log showing Full (Type 2) with Mandatory Label S-1-16-12288, or ProcessTokenElevation in DeviceProcessEvents.

Live and in Memory

Each question has the tools that answer it on a running machine, and in a memory image, a copy of its memory saved to a file.

In a memory image, windows.getsids reads the account, groups and integrity level from each process's token, and windows.privileges its privileges. Live, AccessChk reads one process's full token. Event 4688 in the Security log, written when Audit Process Creation is on, records each new process's elevation type and integrity level.

  • Who is it running as, at what integrity level, and with which privileges on?

    On a Running Machine

    • AccessChk (documentation, opens in a new tab)Live Machine A free Microsoft tool that shows what access an account has to a file, key or process. accesschk -p -f -v <process> With -p and -f, the process token's groups and privileges. Adding -v shows integrity levels too.
    • Get-Process (documentation, opens in a new tab)Live Machine A PowerShell command built into Windows that lists the processes running now. Get-Process -IncludeUserName With -IncludeUserName, run from an elevated session, it adds each process's owning account.
    • Windows.System.Pslist (documentation, opens in a new tab)Live Machine A Velociraptor artifact. It is a ready-made question Velociraptor asks of running machines, named from general to specific. Pslist means process list. Each process with its user and whether its token is elevated.
    • whoami (documentation, opens in a new tab)Live Machine A command built into Windows that shows the account you run as, with its groups and privileges. whoami /all Your own token only, with its groups, privileges and their state.

    In a Memory Image

  • Is a thread working under another account?

    On a Running Machine

    In a Memory Image

    None

To take it offline, read Dumping a Process and Memory

What It Misses

Every way of looking has gaps, so cover these from another source.

  • Event 4688 in the Security log records the token at creation only. A privilege enabled later shows only in event 4703, which needs its own audit setting under Policy Change and is noisy even then, or in a live or memory check.
  • No Sysmon event records a token change or an impersonating thread. Event 4703 in the Security log and the ProcessPrimaryTokenModified action in Defender's DeviceEvents record token changes, and Windows.Detection.Impersonation finds impersonating threads, live.

False Positives

These look odd but are normal, so rule them out before you act.

  • Every elevation a person approves has the same shape as a suspicious one, a medium integrity program named as the parent of a Full (Type 2) child. Rank rare pairs, and never treat the shape alone as a finding.
  • Management agents, installers and scheduled tasks start programs as SYSTEM, so read the parent before anything else.
  • Programs turn their own privileges on and off as they run, so event 4703 in the Security log is not a finding by itself.

Red Flags It Explains

Each red flag below is confirmed by reading this part.

  • Wrong Account Read the account from the process token, live with Get-Process and its user name option. In a memory image windows.getsids lists the token's SIDs, its integrity level among them.

Checks That Use It

These checks read this part as one of their steps.

Hunt It

The same hunt is written for four tools, so pick the one you use. Defender XDR and Sentinel queries are in KQL, which you paste into Advanced hunting in the Defender portal or into Sentinel's Logs page. Splunk queries are in SPL, for its Search page, and Velociraptor queries are in VQL, which you run as a hunt.

Sees It DirectlyDeviceProcessEvents (documentation, opens in a new tab)

Needs Defender for Endpoint. Every approved elevation has this shape, so the common pairs are normal. Read only the rare ones, and confirm the person asked for the elevation before calling it a finding.

KQLDefender XDR, Advanced hunting
// Elevated processes started by a medium integrity parent, by parent and child, rarest pairs firstDeviceProcessEvents| where Timestamp > ago(30d)| where ProcessTokenElevation == "TokenElevationTypeFull" and InitiatingProcessIntegrityLevel == "Medium"| summarize Devices = dcount(DeviceId), Starts = count(), FirstSeen = min(Timestamp), LastSeen = max(Timestamp) by InitiatingProcessFileName, FileName, FolderPath| order by Devices asc, Starts asc

Related

Sources

MITRE ATT&CK is a free public catalogue of the techniques attackers use. Each technique has an ID, such as T1055 for Process Injection, so defenders can name the same behaviour the same way. Reading this part helps find these techniques.