Device-ProcessModifiedPrimaryToken.kql

//Find when a process modifies the primary access token and parse the relevant details such as any privilege attached to the token, whether it is system level and the token integrity level
//Microsoft Sentinel query
DeviceEvents
| where TimeGenerated > ago(30m)
| project
    DeviceName,
    ActionType,
    AdditionalFields,
    TimeGenerated,
    InitiatingProcessParentFileName,
    InitiatingProcessCommandLine
| where ActionType == "ProcessPrimaryTokenModified"
| extend TokenModificationProperties = AdditionalFields.TokenModificationProperties
| where isnotempty(TokenModificationProperties)
| parse TokenModificationProperties with * 'tokenChangeDescription":"' ['Token Change Description'] '","privilegesFlags":' ['Token Privileges'] ',"isChangedToSystemToken":' ['is Changed to System Token'] ',"originalTokenIntegrityLevelName":"' ['Original Token Level'] '","currentTokenIntegrityLevelName":"' ['Current Token Level'] '"' *
| project
    TimeGenerated,
    DeviceName,
    InitiatingProcessParentFileName,
    InitiatingProcessCommandLine,
    ['Original Token Level'],
    ['Current Token Level'],
    ['Token Privileges'],
    ['is Changed to System Token'],
    ['Token Change Description']

//Advanced Hunting query
DeviceEvents
| where Timestamp > ago(30m)
| project
    DeviceName,
    ActionType,
    AdditionalFields,
    Timestamp,
    InitiatingProcessParentFileName,
    InitiatingProcessCommandLine
| where ActionType == "ProcessPrimaryTokenModified"
| extend AF = parse_json(AdditionalFields)
| extend OriginalTokenLevel = AF.OriginalTokenIntegrityLevel
| extend OriginalTokenPriv = AF.OriginalTokenPrivEnabled
| extend CurrentTokenLevel = AF.CurrentTokenIntegrityLevel
| extend CurrentTokenPriv = AF.CurrentTokenPrivEnabled
| extend TokenModification = AF.TokenModificationProperties