Privilege escalation is a commonly employed attack vector in the Windows operating system environment. Attackers often leverage offensive tools such as Meterpreter, CobaltStrike, or Potato tools to execute code such as “NT AUTHORITYSYSTEM.”  These tools typically employ token duplication and service manipulation techniques to perform attacks like LSASS tinkering.

Source: GBHackers