Access Token Manipulation: Make and Impersonate Token

Threat Actors may make new tokens and impersonate users to escalate privileges and bypass access controls. For example, if Threat Actors has a username and password but the user is not logged onto the system the adversary can then create a logon session for the user using the LogonUser function. The function will return a copy of the new session's access token and the adversary can use SetThreadToken to assign the token to a thread.