Make and Impersonate Token

Adversaries may make and impersonate tokens to escalate privileges and bypass access controls. If an adversary has a username and password but the user is not logged onto the system, the adversary can then create a logon session for the user using the LogonUser function. The function will return a copy of the new session's access token and the adversary can use SetThreadToken to assign the token to a thread.

References:

Private Sitedinhngtu.wordpress.com

http://www.harmj0y.net/blog/redteaming/from-kekeo-to-rubeus/www.harmj0y.net

Tenable One Identity ExposureTenable®

https://book.hacktricks.xyz/windows/windows-local-privilege-escalation/privilege-escalation-abusing-tokensbook.hacktricks.xyz