{"id":"T1550.001","name":"Application Access Token","url":"https://attack.mitre.org/techniques/T1550/001","tactics":["lateral-movement"],"platforms":["Containers","IaaS","Identity Provider","Office Suite","SaaS"],"live":true,"revoked":false,"deprecated":false,"revoked_by":null,"detection_strategies":[{"id":"DET0185","stix_id":"x-mitre-detection-strategy--afdf49f9-905d-49e4-9e42-5726f35e87e4","name":"Behavioral Detection Strategy for Use Alternate Authentication Material: Application Access Token (T1550.001)","url":"https://attack.mitre.org/detectionstrategies/DET0185","analytics":[{"id":"AN0526","stix_id":"x-mitre-analytic--43ccb88d-8d8a-4ddb-9ffd-3d897fba76a3","name":"Analytic 0526","description":"Use of AWS STS or GCP IAM APIs to request temporary tokens or federation sessions inconsistent with normal account activity, including from unexpected principals or regions.","url":"https://attack.mitre.org/detectionstrategies/DET0185#AN0526","platforms":["IaaS"],"log_source_references":[{"name":"AWS:CloudTrail","channel":"AssumeRole, GetFederationToken, GetSessionToken","data_component":"DC0007","data_component_name":"Web Credential Usage","log_source_slug":"aws-cloudtrail"},{"name":"AWS:CloudTrail","channel":"sts:GetFederationToken","data_component":"DC0002","data_component_name":"User Account Authentication","log_source_slug":"aws-cloudtrail"}],"mutable_elements":[{"field":"GeoIPDistanceThreshold","description":"Distance between token creation and resource use locations"},{"field":"RoleScope","description":"Limit scope of acceptable role assumptions by account type"}],"live":true,"detection_strategies":["DET0185"],"techniques":["T1550.001"]},{"id":"AN0527","stix_id":"x-mitre-analytic--d203b007-e462-4842-82ce-c97f52c17e39","name":"Analytic 0527","description":"OAuth or SAML access tokens reused across multiple sessions or clients without corresponding MFA or login activity.","url":"https://attack.mitre.org/detectionstrategies/DET0185#AN0527","platforms":["Identity Provider"],"log_source_references":[{"name":"azure:signinlogs","channel":"TokenIssued, RefreshTokenUsed","data_component":"DC0007","data_component_name":"Web Credential Usage","log_source_slug":"azure-signinlogs"},{"name":"m365:unified","channel":"Delegated permission grants without user login event","data_component":"DC0002","data_component_name":"User Account Authentication","log_source_slug":"m365-unified"}],"mutable_elements":[{"field":"MFAEnforcement","description":"Ensure MFA context exists prior to token issuance"},{"field":"TokenReuseWindow","description":"Maximum acceptable window for refresh token reuse"}],"live":true,"detection_strategies":["DET0185"],"techniques":["T1550.001"]},{"id":"AN0528","stix_id":"x-mitre-analytic--dfad1a86-de44-40b2-95b5-9b18c4103cbb","name":"Analytic 0528","description":"Application access tokens used to call APIs (e.g., Google Workspace, Salesforce) without interactive logins, often with unusual scopes or elevated permissions.","url":"https://attack.mitre.org/detectionstrategies/DET0185#AN0528","platforms":["SaaS"],"log_source_references":[{"name":"saas:googleworkspace","channel":"OAuthTokenGranted, APIRequest","data_component":"DC0007","data_component_name":"Web Credential Usage","log_source_slug":"saas-googleworkspace"},{"name":"saas:salesforce","channel":"API login using access_token without login history","data_component":"DC0002","data_component_name":"User Account Authentication","log_source_slug":"saas-salesforce"}],"mutable_elements":[{"field":"ApplicationScopeAllowlist","description":"Restrict allowed API scopes for enterprise applications"},{"field":"TokenLifetime","description":"Threshold for detecting unusually long-lived tokens"}],"live":true,"detection_strategies":["DET0185"],"techniques":["T1550.001"]},{"id":"AN0529","stix_id":"x-mitre-analytic--9680d434-3470-4a35-bf48-1785ab14d831","name":"Analytic 0529","description":"OAuth token usage for Exchange Online or SharePoint API access without preceding login or from unauthorized clients.","url":"https://attack.mitre.org/detectionstrategies/DET0185#AN0529","platforms":["Office Suite"],"log_source_references":[{"name":"m365:unified","channel":"OAuthTokenIssued, FileAccessed, MailItemsAccessed","data_component":"DC0007","data_component_name":"Web Credential Usage","log_source_slug":"m365-unified"}],"mutable_elements":[{"field":"ClientAppIDWhitelist","description":"Restrict trusted Office apps authorized to request tokens"}],"live":true,"detection_strategies":["DET0185"],"techniques":["T1550.001"]},{"id":"AN0530","stix_id":"x-mitre-analytic--03216652-ada9-4c1e-88c4-923c2cb60614","name":"Analytic 0530","description":"Compromised service account tokens mounted inside containers and reused for external API calls or lateral movement across services.","url":"https://attack.mitre.org/detectionstrategies/DET0185#AN0530","platforms":["Containers"],"log_source_references":[{"name":"kubernetes:apiserver","channel":"serviceAccount token used in API requests not tied to workload identity","data_component":"DC0007","data_component_name":"Web Credential Usage","log_source_slug":"kubernetes-apiserver"},{"name":"AWS:CloudTrail","channel":"AssumeRoleWithWebIdentity","data_component":"DC0002","data_component_name":"User Account Authentication","log_source_slug":"aws-cloudtrail"}],"mutable_elements":[{"field":"NamespaceScope","description":"Restrict token use to specific namespaces or workloads"}],"live":true,"detection_strategies":["DET0185"],"techniques":["T1550.001"]}],"live":true,"version":"1.0","techniques":["T1550.001"]}],"sigma_rules":[{"id":"905d389b-b853-46d0-9d3d-dea0d3a3cd49","title":"AWS STS AssumeRole Misuse","author":"Austin Songer @austinsonger","status":"test","level":"low","date":"2021-07-24","modified":"2022-10-09","description":"Identifies the suspicious use of AssumeRole. Attackers could move laterally and escalate privileges.","references":["https://github.com/elastic/detection-rules/pull/1214","https://docs.aws.amazon.com/STS/latest/APIReference/API_AssumeRole.html"],"logsource":{"product":"aws","service":"cloudtrail"},"tags":["attack.lateral-movement","attack.privilege-escalation","attack.t1548","attack.t1550","attack.t1550.001"],"path":"rules/cloud/aws/cloudtrail/aws_sts_assumerole_misuse.yml","techniques":["T1548","T1550","T1550.001"],"cves":[]},{"id":"b45ab1d2-712f-4f01-a751-df3826969807","title":"AWS STS GetSessionToken Misuse","author":"Austin Songer @austinsonger","status":"test","level":"low","date":"2021-07-24","modified":"2022-10-09","description":"Identifies the suspicious use of GetSessionToken. Tokens could be created and used by attackers to move laterally and escalate privileges.","references":["https://github.com/elastic/detection-rules/pull/1213","https://docs.aws.amazon.com/STS/latest/APIReference/API_GetSessionToken.html"],"logsource":{"product":"aws","service":"cloudtrail"},"tags":["attack.lateral-movement","attack.privilege-escalation","attack.t1548","attack.t1550","attack.t1550.001"],"path":"rules/cloud/aws/cloudtrail/aws_sts_getsessiontoken_misuse.yml","techniques":["T1548","T1550","T1550.001"],"cves":[]},{"id":"f43f5d2f-3f2a-4cc8-b1af-81fde7dbaf0e","title":"AWS Suspicious SAML Activity","author":"Austin Songer","status":"test","level":"medium","date":"2021-09-22","modified":"2022-12-18","description":"Identifies when suspicious SAML activity has occurred in AWS. An adversary could gain backdoor access via SAML.","references":["https://docs.aws.amazon.com/IAM/latest/APIReference/API_UpdateSAMLProvider.html","https://docs.aws.amazon.com/STS/latest/APIReference/API_AssumeRoleWithSAML.html"],"logsource":{"product":"aws","service":"cloudtrail"},"tags":["attack.initial-access","attack.lateral-movement","attack.persistence","attack.privilege-escalation","attack.stealth","attack.t1078","attack.t1548","attack.t1550","attack.t1550.001"],"path":"rules/cloud/aws/cloudtrail/aws_susp_saml_activity.yml","techniques":["T1078","T1548","T1550","T1550.001"],"cves":[]},{"id":"f8103686-e3e8-46f3-be72-65f7fcb4aa53","title":"AWS Console GetSigninToken Potential Abuse","author":"Chester Le Bron (@123Le_Bron)","status":"test","level":"medium","date":"2024-02-26","modified":null,"description":"Detects potentially suspicious events involving \"GetSigninToken\".\nAn adversary using the \"aws_consoler\" tool can leverage this console API to create temporary federated credential that help obfuscate which AWS credential is compromised (the original access key) and enables the adversary to pivot from the AWS CLI to console sessions without the need for MFA using the new access key issued in this request.\n","references":["https://github.com/NetSPI/aws_consoler","https://www.crowdstrike.com/blog/analysis-of-intrusion-campaign-targeting-telecom-and-bpo-companies/"],"logsource":{"product":"aws","service":"cloudtrail"},"tags":["attack.lateral-movement","attack.t1021.007","attack.t1550.001"],"path":"rules/cloud/aws/cloudtrail/aws_console_getsignintoken.yml","techniques":["T1021.007","T1550.001"],"cves":[]}],"kev_cves":[],"_built":"2026-08-23 05:47 UTC","_attack_version":"19.2","_sigma_commit":"da9bb07d642a2826e89702445d32c795209ec108"}