ShinyHuntersG1057 ↗
Has used stolen OAuth keys to access cloud infrastructure and to bypass two-factor authentication.1
tfMITRE ATT&CK sub-technique
Application Access Token T1550.001
sub-technique of T1550 Use Alternate Authentication Material
- Tactic
- Lateral Movement
- Platforms
- Containers, IaaS, Identity Provider, Office Suite, SaaS
- Version
- 2.0
- Created
- 30 January 2020
- Last modified
- 12 May 2026
- Contributors
- Blake Strom, Microsoft Threat Intelligence; Dylan Silva, AWS Security; Ian Davila, Tidal Cyber; Jack Burns, HubSpot; Jeff Sakowicz, Microsoft Identity Developer Platform Services (IDPM Services); Mark Wee; Pawel Partyka, Microsoft Threat Intelligence; Saisha Agrawal, Microsoft Threat Intelligent Center (MSTIC); Shailesh Tiwary (Indian Army)
Adversaries may use stolen application access tokens to bypass the typical authentication process and access restricted accounts, information, or services on remote systems. These tokens are typically stolen from users or services and used in lieu of login credentials.
ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact
4
Threat groups70th pct
Threat groups70th percentile · 70% of ATT&CK techniques have this many threat groups attributed or fewer.1
Campaigns72nd pct
Campaigns72nd percentile · 72% of ATT&CK techniques have this many campaigns recorded or fewer.6
Tools & malware68th pct
Tools & malware68th percentile · 68% of ATT&CK techniques have this many tools implementing them or fewer.4
Detection rules60th pct
Detection rules60th percentile · 60% of ATT&CK techniques have this many detection rules written or fewer.Application Access Token MITRE reference T1550.001
70th pctamong all ATT&CK techniques for number of groups
4 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.
TeamPCPG1056 ↗
Has used stolen access tokens to inject malicious code into CI/CD workflows and to exfiltrate sensitive data from cloud, developer, and container environments.123
HAFNIUMG0125 ↗
Has abused service principals with administrative permissions for data exfiltration.1
APT28G0007 ↗
Has used several malicious applications that abused OAuth access tokens to gain access to target email accounts, including Gmail and Yahoo Mail.1
All 4 groups for this technique
1 campaign has been recorded using this technique. Listed newest first; dates are year-granularity and attribution is MITRE’s.
SolarWinds CompromiseC0024 ↗
During the SolarWinds Compromise, APT29 used compromised service principals to make changes to the Office 365 environment.1
All 1 campaigns for this technique
6 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.
Kali365S9044 ↗
Has utilized an Exchange Admin module that captured admin tokens to create rogue mailbox connectors and change mail-flow rules.1
Mini Shai-HuludS9043 ↗
Has the ability to authenticate using stolen application access tokens.123
CanisterWormS9042 ↗
Has leveraged stolen npm tokens to automate compromise by enumerating all publishable packages in a namespace, bumping versions, and publishing itself across the entire scope.12
Shai-HuludS9008 ↗
Has leveraged captured valid NPM tokens to enumerate and update packages on compromised accounts.123 Shai-Hulud has also utilized stolen GitHub access tokens to access compromised accounts.23
CreepyDriveS1023 ↗
Can use legitimate OAuth refresh tokens to authenticate with OneDrive.1
PeiratesS0683 ↗
Can use stolen service account tokens to perform its operations. It also enables adversaries to switch between valid service accounts.1
All 6 software entries for this technique
Offense vs defense T1550.001
Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.
How it got here
Range
Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.
Campaigns · 1Sigma rules (cumulative) · 4Splunk ESCU (cumulative) · 0
first rule: 2021 Q3 · 1 of 1 campaigns plottedApplication Access Token detection strategy DET0185
MITRE names one behaviour worth catching for this technique and breaks it into 5 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.
Behavioral Detection Strategy for Use Alternate Authentication Material: Application Access Token (T1550.001)
5 platforms
AN0526 · IaaS
Use of AWS STS or GCP IAM APIs to request temporary tokens or federation sessions inconsistent with normal account activity, including from unexpected principals or regions.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| User Account AuthenticationDC0002 | AWS:CloudTrail | sts:GetFederationToken |
| Web Credential UsageDC0007 | AWS:CloudTrail | AssumeRole, GetFederationToken, GetSessionToken |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| GeoIPDistanceThreshold | Distance between token creation and resource use locations |
| RoleScope | Limit scope of acceptable role assumptions by account type |
AN0527 · Identity Provider
OAuth or SAML access tokens reused across multiple sessions or clients without corresponding MFA or login activity.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| User Account AuthenticationDC0002 | m365:unified | Delegated permission grants without user login event |
| Web Credential UsageDC0007 | azure:signinlogs | TokenIssued, RefreshTokenUsed |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| MFAEnforcement | Ensure MFA context exists prior to token issuance |
| TokenReuseWindow | Maximum acceptable window for refresh token reuse |
AN0528 · SaaS
Application access tokens used to call APIs (e.g., Google Workspace, Salesforce) without interactive logins, often with unusual scopes or elevated permissions.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| User Account AuthenticationDC0002 | saas:salesforce | API login using access_token without login history |
| Web Credential UsageDC0007 | saas:googleworkspace | OAuthTokenGranted, APIRequest |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| ApplicationScopeAllowlist | Restrict allowed API scopes for enterprise applications |
| TokenLifetime | Threshold for detecting unusually long-lived tokens |
AN0529 · Office Suite
OAuth token usage for Exchange Online or SharePoint API access without preceding login or from unauthorized clients.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Web Credential UsageDC0007 | m365:unified | OAuthTokenIssued, FileAccessed, MailItemsAccessed |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| ClientAppIDWhitelist | Restrict trusted Office apps authorized to request tokens |
AN0530 · Containers
Compromised service account tokens mounted inside containers and reused for external API calls or lateral movement across services.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| User Account AuthenticationDC0002 | AWS:CloudTrail | AssumeRoleWithWebIdentity |
| Web Credential UsageDC0007 | kubernetes:apiserver | serviceAccount token used in API requests not tied to workload identity |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| NamespaceScope | Restrict token use to specific namespaces or workloads |
Account Use PoliciesM1036
Where possible, consider restricting the use of access tokens outside of expected contexts. For example, in AWS environments, consider using data perimeters to prevent credential use outside of an expected network.
Consider implementing token binding strategies, such as Azure AD token protection or OAuth Proof of Possession, that cryptographically bind a token to a secret. This may prevent the token from being used without knowledge of the secret or possession of the device the token is tied to.
AuditM1047
Administrators should audit all cloud and container accounts to ensure that they are necessary and that the permissions granted to them are appropriate. Where possible, the ability to request temporary account tokens on behalf of another accounts should be disabled. Additionally, administrators can leverage audit tools to monitor actions that can be conducted as a result of OAuth 2.0 access. For instance, audit reports enable admins to identify privilege escalation actions such as role creations or policy modifications, which could be actions performed after initial access.
File encryption should be enforced across email communications containing sensitive information that may be obtained through access to email services.
Update corporate policies to restrict what types of third-party applications may be added to any online service or tool that is linked to the company's information, accounts or network (e.g., Google, Microsoft, Dropbox, Basecamp, GitHub). However, rather than providing high-level guidance on this, be extremely specific—include a list of per-approved applications and deny all others not on the list. Administrators may also block end-user consent through administrative portals, such as the Azure Portal, disabling users from authorizing third-party apps through OAuth and forcing administrative consent.