Access Token Manipulation: Token Impersonation/Theft

Threat Actors may duplicate then impersonate another user's existing token to escalate privileges and bypass access controls. For example, Threat Actors can duplicate an existing token using DuplicateToken or DuplicateTokenEx. The token can then be used with ImpersonateLoggedOnUser to allow the calling thread to impersonate a logged on user's security context, or with SetThreadToken to assign the impersonated token to a thread.