Please help to identify the following description belonging to which technique in MITRE and the corresponding tactics: REvil can obtain the token from the user that launched the explorer.exe process to avoid affecting the desktop of the SYSTEM user.