Token Impersonation/Theft

Token Impersonation/Theft (T1134.001) duplicates an existing Windows process access token and assigns it as a thread impersonation token so the caller can act under that identity where authorized. The procedure uses an existing token; it does not create a token from credentials (T1134.003) or start a child process with a primary token (T1134.002). Privilege escalation depends on the selected token having greater privileges or access. Remote use additionally depends on delegation level and destination permissions; token impersonation does not reveal the account's plaintext password or NTLM hash.