THREATNOIR
Subscribe
MITRE ATT&CK · T1528

Steal Application Access Token

MITRE · cited in 32 of our lessons

Explanation

What attackers do. Attackers steal application access tokens, such as OAuth tokens, to access cloud services and APIs as a user or application without needing a password. Malicious consent apps and token theft from endpoints are common routes. This serves the Credential Access tactic.

How to defend. Restrict user consent to third-party applications and require admin review for high-privilege permissions. Shorten token lifetimes, use conditional access to bind tokens to compliant devices, and revoke tokens during incident response. Audit the applications and service principals that hold access to mail, files and directories.

Signs to look for. Look for newly consented applications with broad permissions, token use from unfamiliar IP addresses, and API access patterns unlike the user's normal behaviour. A common gap is that password resets do not revoke existing tokens.

Open the technique on MITRE ATT&CK
The official text
Adversaries can steal application access tokens as a means of acquiring credentials to access remote systems and resources. Application access tokens are used to make authorized API requests on behalf of a user or service and are commonly used as a way to access resources in cloud and container-based applications and software-as-a-service (SaaS). Adversaries who steal account API tokens in cloud and containerized environments may be able to access data and perform actions with the permissions of these accounts, which can lead to privilege escalation and further compromise of the environment. For example, in Kubernetes environments, processes running inside a container may communicate with the Kubernetes API server using service account tokens. If a container is compromised, an adversary may be able to steal the container’s token and thereby gain access to Kubernetes API commands.

© The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation (MITRE ATT&CK®).

Lessons that cite it

Real incidents where this item mattered: the latest 12 of 32.