THREATNOIR
Subscribe
MITRE ATT&CK · T1550.001

Application Access Token

MITRE · cited in 11 of our lessons

Explanation

What attackers do. Attackers reuse stolen application access tokens, such as OAuth tokens, to call APIs and access cloud services without logging in again. This lets them bypass passwords and MFA and serves Defence Evasion and Lateral Movement.

How to defend. Shorten token lifetimes, use conditional access and token binding where available, and make sure incident response includes revoking tokens and refresh tokens, not just resetting passwords. Review applications and service principals with broad API permissions. Collect cloud audit and sign-in logs that record token use.

Signs to look for. Look for API activity from IP addresses or locations unlike the user's normal ones, token use continuing after a password reset, and high-volume mailbox or file access through APIs. A common gap is incomplete logging of non-interactive sign-ins.

Open the technique on MITRE ATT&CK
The official text
Adversaries may use stolen application access tokens to bypass the typical authentication process and access restricted accounts, information, or services on remote systems. These tokens are typically stolen from users or services and used in lieu of login credentials. Application access tokens are used to make authorized API requests on behalf of a user or service and are commonly used to access resources in cloud, container-based applications, and software-as-a-service (SaaS). OAuth is one commonly implemented framework that issues tokens to users for access to systems. These frameworks are used collaboratively to verify the user and determine what actions the user is allowed to perform. Once identity is established, the token allows actions to be authorized, without passing the actual credentials of the user. Therefore, compromise of the token can grant the adversary access to resources of other sites through a malicious application.

© The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation (MITRE ATT&CK®).

Lessons that cite it

Real incidents where this item mattered.