Adversaries may duplicate then impersonate another user’s existing token to escalate privileges and bypass access controls.

Tactics
TA0004 TA0005

Sub-technique of
T1134


See: MITRE ATT&CK