Carbon Black Cloud: The Application [Application] has Impersonated a Non-System User

Products

• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)
• Carbon Black Cloud Enterprise EDR (formerly Cb Threathunter)

Issue/Introduction

• Getting an increasing amount of alerts similar to: 

The application excel.exe has impersonated a non-system user.

• Reason code for alert: "T_IMPERSONATE_USER"

Environment

• Carbon Black Cloud Windows Sensor: 3.8.x and Higher
• Microsoft Windows: All supported versions

Cause

• These alerts are mainly due to the TTP associated with these actions
  • TTPs: impersonate_user, code_drop, mitre_t1134_access_token_manip 
• The alerts are generated when the user that is associated with an application or process changes during the course of execution to something other than NT AUTHORITY\SYSTEM, the system tracks the username of system/root to another user

Resolution

• Avoid these results with running the application with the System/Root user (NT AUTHORITY\SYSTEM).
• If these are believed to be false positives in the environment, they could be dismissed using the following method here.