Token impersonation
Named by 3 kept items in this workspace.
2 items name it under techniques and 1 under classification.key entities.
Search every workspace for Token impersonation. It matches the name as written, so it can find other things that share it.
The items that name it 3
Malware calls DuplicateToken to obtain an impersonation token from a primary token, sets it on a suspended thread via ZwSetInformationThread, sets ThreadHideFromDebugger, and resumes the thread via NtResumeThread for privilege escalation and anti-debugging.
Use of OpenProcessToken, AdjustTokenPrivileges, DuplicateTokenEx, ImpersonateLoggedOnUser, LogonUserW to impersonate the logged-on user, enabling access to that user's browser profile data and launching explorer on the hidden RTSC desktop under the correct context.
All techniques in this workspace.