Windows token-impersonation privesc (Potato family)

When it applies

You have code execution on Windows as a service or web account (IIS iis apppool, MSSQL, a service) that holds SeImpersonatePrivilege (or SeAssignPrimaryTokenPrivilege). These accounts can't do much directly but can impersonate a token — and coax SYSTEM into handing one over.

Why it works

SeImpersonate lets a process act with any token it can obtain. The "Potato" technique tricks a SYSTEM service (via a local RPC/named-pipe/COM authentication) into authenticating to an attacker-controlled pipe; the low-priv process impersonates that SYSTEM token and spawns a process as SYSTEM.