Adversaries may make new tokens and impersonate users to escalate privileges and bypass access controls. For example, if an adversary has a username and password but the user is not logged onto the system the adversary can then create a logon session for the user using the `LogonUser` function.(Citation: LogonUserW function) The function will return a copy of the new session's access token and the adversary can use `SetThreadToken` to assign the token to a thread.

This behavior is distinct from [Token Impersonation/Theft](https://attack.mitre.org/techniques/T1134/001) in that this refers to creating a new user token instead of stealing or duplicating an existing one.
Make and Impersonate Token
source_name: mitre-attack  url: https://attack.mitre.org/techniques/T1134/003  external_id: T1134.003     source_name: Microsoft Command-line Logging  description: Mathers, B. (2017, March 7). Command line process auditing. Retrieved April 21, 2017.  url: https://technet.microsoft.com/en-us/windows-server-docs/identity/ad-ds/manage/component-updates/command-line-process-auditing     source_name: LogonUserW function  description: Microsoft. (2023, March 10). LogonUserW function (winbase.h). Retrieved January 8, 2024.  url: https://learn.microsoft.com/en-us/windows/win32/api/winbase/nf-winbase-logonuserw     