EXPLORE
← Back to Explore
T1550.001

Application Access Token

Adversaries may use stolen application access tokens to bypass the typical authentication process and access restricted accounts, information, or services on remote systems. These tokens are typically stolen from users or services and used in lieu of login credentials. Application access tokens are used to make authorized API requests on behalf of a user or service and are commonly used to access resources in cloud, container-based applications, and software-as-a-service (SaaS).(Citation: Auth0...

SaaSContainersIaaSOffice SuiteIdentity Provider
30
Detections
2
Sources
2
Threat Actors

BY SOURCE

26elastic4sigma

PROCEDURES (22)

Suspicious4 detections

Auto-extracted: 4 detections for suspicious

Powershell3 detections

Auto-extracted: 3 detections for powershell

Aws2 detections

Auto-extracted: 2 detections for aws

Bypass2 detections

Auto-extracted: 2 detections for bypass

Persist2 detections

Auto-extracted: 2 detections for persist

Email1 detections

Auto-extracted: 1 detections for email

Phish1 detections

Auto-extracted: 1 detections for phish

Impersonat1 detections

Auto-extracted: 1 detections for impersonat

Impersonat1 detections

Auto-extracted: 1 detections for impersonat

Azure1 detections

Auto-extracted: 1 detections for azure

Cloud1 detections

Auto-extracted: 1 detections for cloud

Privilege1 detections

Auto-extracted: 1 detections for privilege

Email1 detections

Auto-extracted: 1 detections for email

Azure1 detections

Auto-extracted: 1 detections for azure

Kubernetes1 detections

Auto-extracted: 1 detections for kubernetes

Container1 detections

Auto-extracted: 1 detections for container

Bypass1 detections

Auto-extracted: 1 detections for bypass

Credential1 detections

Auto-extracted: 1 detections for credential

Persist1 detections

Auto-extracted: 1 detections for persist

Cloud1 detections

Auto-extracted: 1 detections for cloud

Container1 detections

Auto-extracted: 1 detections for container

Impersonat1 detections

Auto-extracted: 1 detections for impersonat

THREAT ACTORS (2)

DETECTIONS (30)

AWS Console GetSigninToken Potential Abuse
sigmamedium
AWS EC2 Instance Console Login via Assumed Role
elastichigh
AWS First Occurrence of STS GetFederationToken Request by User
elasticmedium
AWS STS AssumeRole Misuse
sigmalow
AWS STS AssumeRole with New MFA Device
elasticlow
AWS STS GetSessionToken Misuse
sigmalow
AWS STS Role Assumption by Service
elasticlow
AWS STS Role Assumption by User
elasticlow
AWS STS Role Chaining
elasticmedium
AWS Suspicious SAML Activity
sigmamedium
Direct Interactive Kubernetes API Request Detected via Defend for Containers
elasticlow
Entra ID Actor Token User Impersonation Abuse
elasticmedium
Entra ID Concurrent Sign-in with Suspicious Properties
elastichigh
Entra ID OAuth Authorization Code Grant for Unusual User, App, and Resource
elasticmedium
Entra ID OAuth Device Code Grant by Microsoft Authentication Broker
elasticmedium
Entra ID OAuth Device Code Grant by Unusual User
elasticmedium
Entra ID OAuth Flow by Microsoft Authentication Broker to Device Registration Service (DRS)
elastichigh
Entra ID OAuth Phishing via First-Party Microsoft Application
elasticmedium
Entra ID OAuth PRT Issuance to Non-Managed Device Detected
elasticmedium
Entra ID OAuth User Impersonation to Microsoft Graph
elasticmedium
Entra ID OAuth user_impersonation Scope for Unusual User and Client
elasticmedium
Entra ID Service Principal Federated Credential Authentication by Unusual Client
elasticmedium
Entra ID User Sign-in with Unusual Client
elasticmedium
First Time Seen Google Workspace OAuth Login from Third-Party Application
elasticmedium
M365 Identity OAuth Flow by First-Party Microsoft App from Multiple IPs
elastichigh
Microsoft Graph Request Email Access by Unusual User and Client
elasticmedium
Microsoft Graph Request User Impersonation by Unusual Client
elasticlow
Potential Impersonation Attempt via Kubectl
elasticmedium
Service Account Token or Certificate Access Followed by Kubernetes API Request
elasticmedium
Unauthorized Scope for Public App OAuth2 Token Grant with Client Credentials
elasticmedium