mimikatz token::elevate

mimikatz # privilege::debug ; token::elevate

Elevates the current process token to SYSTEM by impersonating a high-privilege token via the NtImpersonateThread API.

When you have a shell as Administrator but need SYSTEM privileges to read lsass or interact with services. It is the standard preliminary step to sekurlsa::logonpasswords and also works against tokens from other processes (token::impersonate).

If the host has PPL active (protected lsass), elevation to SYSTEM is not enough to dump credentials. In environments with EDR monitoring NtImpersonateThread, it may trigger an immediate alert.