T1550.001sub-technique of T1550 Use Alternate Authentication Material
Application Access Token
Containers · IaaS · Identity Provider · Office Suite · SaaS5 pieces on this siteT1550.001 on attack.mitre.org
Adversaries may use stolen application access tokens to bypass the typical authentication process and access restricted accounts, information, or services on remote systems. These tokens are typically stolen from users or services and used in lieu of login credentials.
If this is happening now
Checklists and playbooks to open while the alert is still live.
Cloud account compromise
Impossible travel, an unrecognised inbox rule, or a reported invoice-fraud attempt.
A malicious application has consent in the tenant
An unrecognised enterprise application, a consent grant nobody remembers approving, or mail access that survived a password reset.
Detect it
Hunts and rules you can run, each stating what it needs and what else it returns.
Cloud identity and token theft detection pack for Entra ID and Okta
Four Sigma rules for the cloud identity attacks that actually land: illicit consent grants, authentication methods added after a risky sign-in, help-desk MFA resets, and session tokens replayed from a second address.
The evidence it leaves
Where the traces live, and what each source proves and does not.
Entra ID sign-in logs
Practise it
Labs, timelines, evidence packs and tabletop scenarios to work before you need to.
Guided lab: the mailbox rule that was not the point
A business email compromise where the obvious finding is a decoy. Ninety minutes on Microsoft 365 audit logs, OAuth consent grants, and why resetting the password does not end this incident.
how MITRE says to see it
Behavioral Detection Strategy for Use Alternate Authentication Material: Application Access Token (T1550.001)
- Use of AWS STS or GCP IAM APIs to request temporary tokens or federation sessions inconsistent with normal account activity, including from unexpected principals or regions.
- OAuth or SAML access tokens reused across multiple sessions or clients without corresponding MFA or login activity.
- Application access tokens used to call APIs (e.g., Google Workspace, Salesforce) without interactive logins, often with unusual scopes or elevated permissions.
- OAuth token usage for Exchange Online or SharePoint API access without preceding login or from unauthorized clients.
what reduces it
- M1021 Restrict Web-Based Content. Update corporate policies to restrict what types of third-party applications may be added to any online service or tool that is linked to the company's information, accounts or network (e.g., Google, Microsoft, Dropbox, Basecamp, GitHub). However, rather than providing high-level guidance on this, be extremely specific, include a list of per-approved applications and deny all others not on the list.
- M1013 Application Developer Guidance. Consider implementing token binding strategies, such as Azure AD token protection or OAuth Proof of Possession, that cryptographically bind a token to a secret. This may prevent the token from being used without knowledge of the secret or possession of the device the token is tied to.
- M1047 Audit. Administrators should audit all cloud and container accounts to ensure that they are necessary and that the permissions granted to them are appropriate. Where possible, the ability to request temporary account tokens on behalf of another accounts should be disabled. Additionally, administrators can leverage audit tools to monitor actions that can be conducted as a result of OAuth 2.0 access.
- M1036 Account Use Policies. Where possible, consider restricting the use of access tokens outside of expected contexts. For example, in AWS environments, consider using data perimeters to prevent credential use outside of an expected network.
- M1041 Encrypt Sensitive Information. File encryption should be enforced across email communications containing sensitive information that may be obtained through access to email services.