Access Token Theft and Manipulation Attacks – A Door to Local Privilege Escalation

This McAfee technical brief explains how attackers and malware abuse Windows process access tokens—via theft, duplication, and impersonation—to escalate privileges and perform stealthy lateral movement; it outlines attack paths, APIs used, mitigation bypasses (e.g., UAC), and references detection guidance including on-access scanning and a YARA rule with a link to the full technical analysis.