TA0005 · DEFENSE EVASION
Application Access Token
T1550.001Sub-technique of Use Alternate Authentication MaterialSaaS · Containers · IaaS · Office Suite · Identity Providerattack.mitre.org
Adversaries may use stolen application access tokens to bypass the typical authentication process and access restricted accounts, information, or services on remote systems.
Detect it with
Monitor access token activity for abnormal use and permissions granted to unusual or suspicious applications and APIs.
Why it matters on shift
Application Access Token is one of the concrete ways adversaries achieve defense evasion. Recognising it in telemetry lets you name the technique in your ticket and pivot to what came before and after.
What to look for next
After defense evasion, the next tactic is usually Credential Access. Search your telemetry for the transition before closing the ticket.
Kill-chain context