Impersonate Token via Named Pipe / SCM

Windows token impersonation/theft uses an existing user's access token so a thread can act under that security context. These steps cover the direct process-token path: identify a logged-on process whose token is accessible, duplicate its token, then assign the impersonation token to a thread with ImpersonateLoggedOnUser or SetThreadToken. The impersonated thread's effective access depends on the token and impersonation level; this does not inherently make the process or user SYSTEM or guarantee access to another resource. Creating a process from a primary token is the separate T1134.002 procedure. Named-pipe client impersonation is another T1134.001 path, but is not represented by this direct process-token sequence.