value:  PoshC2 can use Invoke-RunAs to make tokens. ;; REvil can launch an instance of itself with administrative rights using runas. ;; Turla RPC backdoors can impersonate or steal process tokens before executing commands. ;; ZxShell has a command called RunAs which creates a new process as another user or process context.
name: Access Token Manipulation: Create Process With Token