EXPLORE
← Back to Explore
T1528

Steal Application Access Token

Adversaries can steal application access tokens as a means of acquiring credentials to access remote systems and resources. Application access tokens are used to make authorized API requests on behalf of a user or service and are commonly used as a way to access resources in cloud and container-based applications and software-as-a-service (SaaS).(Citation: Auth0 - Why You Should Always Use Access Tokens to Secure APIs Sept 2019) Adversaries who steal account API tokens in cloud and containeriz...

SaaSContainersIaaSOffice SuiteIdentity Provider
42
Detections
3
Sources
2
Threat Actors

BY SOURCE

20elastic14sigma8splunk_escu

PROCEDURES (30)

General Monitoring5 detections

Auto-extracted: 5 detections for general monitoring

Azure4 detections

Auto-extracted: 4 detections for azure

Powershell3 detections

Auto-extracted: 3 detections for powershell

Office2 detections

Auto-extracted: 2 detections for office

Persist2 detections

Auto-extracted: 2 detections for persist

Bypass2 detections

Auto-extracted: 2 detections for bypass

Service1 detections

Auto-extracted: 1 detections for service

Impersonat1 detections

Auto-extracted: 1 detections for impersonat

Exfiltrat1 detections

Auto-extracted: 1 detections for exfiltrat

Kubernetes1 detections

Auto-extracted: 1 detections for kubernetes

Phish1 detections

Auto-extracted: 1 detections for phish

Phish1 detections

Auto-extracted: 1 detections for phish

Credential1 detections

Auto-extracted: 1 detections for credential

File Monitoring1 detections

Auto-extracted: 1 detections for file monitoring

Persist1 detections

Auto-extracted: 1 detections for persist

Email1 detections

Auto-extracted: 1 detections for email

Office1 detections

Auto-extracted: 1 detections for office

Impersonat1 detections

Auto-extracted: 1 detections for impersonat

Token1 detections

Auto-extracted: 1 detections for token

Cloud1 detections

Auto-extracted: 1 detections for cloud

Credential1 detections

Auto-extracted: 1 detections for credential

Azure1 detections

Auto-extracted: 1 detections for azure

Kubernetes1 detections

Auto-extracted: 1 detections for kubernetes

Phish1 detections

Auto-extracted: 1 detections for phish

Token1 detections

Auto-extracted: 1 detections for token

Token1 detections

Auto-extracted: 1 detections for token

Suspicious1 detections

Auto-extracted: 1 detections for suspicious

Credential1 detections

Auto-extracted: 1 detections for credential

Privilege1 detections

Auto-extracted: 1 detections for privilege

Phish1 detections

Auto-extracted: 1 detections for phish

THREAT ACTORS (2)

DETECTIONS (42)

Anomalous Token
sigmahigh
Anonymous IP Address
sigmahigh
App Granted Microsoft Permissions
sigmahigh
Application URI Configuration Changes
sigmahigh
Azure AD Device Code Authentication
splunk_escu
Azure AD OAuth Application Consent Granted By User
splunk_escu
Azure AD User Consent Blocked for Risky Application
splunk_escu
Azure AD User Consent Denied for OAuth Application
splunk_escu
Azure Service Principal Sign-In Followed by Arc Cluster Credential Access
elasticmedium
Delegated Permissions Granted For All Users
sigmahigh
End User Consent
sigmalow
End User Consent Blocked
sigmamedium
Entra ID Concurrent Sign-in with Suspicious Properties
elastichigh
Entra ID Illicit Consent Grant via Registered Application
elasticmedium
Entra ID OAuth Authorization Code Grant for Unusual User, App, and Resource
elasticmedium
Entra ID OAuth Device Code Flow with Concurrent Sign-ins
elastichigh
Entra ID OAuth Flow by Microsoft Authentication Broker to Device Registration Service (DRS)
elastichigh
Entra ID OAuth Phishing via First-Party Microsoft Application
elasticmedium
Entra ID OAuth PRT Issuance to Non-Managed Device Detected
elasticmedium
Entra ID User Added as Registered Application Owner
elasticlow
Entra ID User Sign-in with Unusual Client
elasticmedium
GitHub Authentication Token Access via Node.js
elasticmedium
HackTool - Koh Default Named Pipe
sigmacritical
Kubernetes Service Account Secret Access
elasticmedium
M365 Identity OAuth Flow by First-Party Microsoft App from Multiple IPs
elastichigh
M365 Identity OAuth Flow by User Sign-in to Device Registration
elastichigh
M365 Identity OAuth Illicit Consent Grant by Rare Client and User
elasticmedium
M365 Identity Unusual SSO Authentication Errors for User
elasticmedium
Microsoft Graph Request User Impersonation by Unusual Client
elasticlow
Microsoft Teams Sensitive File Access By Uncommon Applications
sigmamedium
New GitHub Personal Access Token (PAT) Added
elasticlow
O365 File Permissioned Application Consent Granted by User
splunk_escu
O365 Mail Permissioned Application Consent Granted by User
splunk_escu
O365 User Consent Blocked for Risky Application
splunk_escu
O365 User Consent Denied for OAuth Application
splunk_escu
Potential Impersonation Attempt via Kubectl
elasticmedium
Potentially Suspicious Command Targeting Teams Sensitive Files
sigmamedium
Potentially Suspicious JWT Token Search Via CLI
sigmamedium
Primary Refresh Token Access Attempt
sigmahigh
Renamed BrowserCore.EXE Execution
sigmahigh
Service Account Token or Certificate Access Followed by Kubernetes API Request
elasticmedium
Suspicious Teams Application Related ObjectAcess Event
sigmahigh