TA0006 · CREDENTIAL ACCESS
Steal Application Access Token
OAuth tokens and cloud session cookies stolen to bypass MFA entirely.
Detect it with
Same session token used from two ASNs; illicit consent grants to newly registered applications.
Why it matters on shift
Steal Application Access Token is one of the concrete ways adversaries achieve credential access. Recognising it in telemetry lets you name the technique in your ticket and pivot to what came before and after.
What to look for next
After credential access, the next tactic is usually Discovery. Search your telemetry for the transition before closing the ticket.
Kill-chain context