Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Tactics TA0004 TA0005 Sub-techniques T1134.001 T1134.002 T1134.003 T1134.004 T1134.005 See: MITRE ATT&CK