Whitepaper discussing token kidnapping on Microsoft Windows.
You can download it from the following link: https://packetstormsecurity.com/files/download/65697/TokenKidnapping.pdf
Source: https://packetstormsecurity.com/files/65697/TokenKidnapping.pdf.html