Users, Privileges & Access Tokens

What is it?

Windows enforces security through access tokens: every process runs with a token describing the user, groups and privileges it holds. Standard users have limited tokens; administrators can elevate. Much of attacker activity on an endpoint is about the token — running as a privileged account, stealing a token, or escalating a standard one to admin or SYSTEM.

Why it matters

Privilege is what turns a foothold into control. Watching which account and privilege level a process runs at — and any elevation — is central to spotting and scoping an intrusion.

Where you see it

The privilege dimension of every endpoint investigation.

What normal looks like

Processes running at the least privilege their function needs; elevation only by authorized admins for known tasks.

What suspicious looks like

A standard user's process suddenly running as SYSTEM, or a service account holding privileges far beyond its job — signs of escalation or token abuse.

How analysts investigate

By tracking the account and integrity/privilege level each process runs at, and treating unexplained elevation as a high-priority lead.

Common beginner mistakes

Looking only at what ran and ignoring the privilege it ran with — the same command is routine as a standard user and an emergency as SYSTEM.

At Fanar, a front-desk clerk's account should never run a process as SYSTEM. When the EDR shows exactly that — a clerk's session spawning a SYSTEM-level process — the privilege dimension just flagged a probable escalation. The command itself might look mundane; the token it ran with is the alarm. Endpoint security reads not just WHAT ran, but AS WHOM and with WHAT power.

Quick check

A front-desk clerk's session spawns a process running as SYSTEM. Why is this significant regardless of what the process does?

A quick self-check — it doesn't affect your XP or progress.