T1528Credential Access
Steal Application Access Token
Adversaries can steal application access tokens as a means of acquiring credentials to access remote systems and resources. Application access tokens are used to make authorized API requests on behalf of a user or service and are commonly used as a way to access resources in cloud and container-based applications and software-as-a-service (SaaS). Adversaries who steal account API tokens in cloud…
CVEs4
In CISA KEVThe US Cybersecurity and Infrastructure Security Agency’s list of Known Exploited Vulnerabilities. A CVE is added when CISA has evidence that attackers are using it.3
Reports1
Detections
14 Sigma rules tagged T1528Steal Application Access TokenT152814 general rules
- HackTool - Koh Default Named Pipecriticaltest
- Anomalous Tokenhightest
- Anonymous IP Addresshightest
- App Granted Microsoft Permissionshightest
- Application URI Configuration Changeshightest
- Delegated Permissions Granted For All Usershightest
- Primary Refresh Token Access Attempthightest
- Renamed BrowserCore.EXE Executionhightest
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
CVEs linked to Steal Application Access Token
4 CVEs, by priority. Each link shows its badge.- CVE-2026-45321TanStack Unspecified VulnerabilityTanStack · TanStackKEVRansomwarePublic exploitCritical · 9.6T1195.002Compromise Software Supply ChainT1528Steal Application Access Token1 reportAI mapping from the description · primary impact3.3%Top 12%86.3priority
- CVE-2026-42018JFrog Artifactory Improper Authentication VulnerabilityJFrog · ArtifactoryKEVPublic exploitHigh · 7.5T1190Exploit Public-Facing ApplicationT1528Steal Application Access TokenAI mapping from the description · primary impact9.8%Top 4.5%77.4priority
- CVE-2024-38475Apache HTTP Server Improper Escaping of Output VulnerabilityApache · HTTP ServerKEVPublic exploitCritical · 9.1T1190Exploit Public-Facing ApplicationT1059Command and Scripting Interpreter+2 moreMITRE CTID mapping of the KEV entry · primary impact>99.9%Top 0.02%69.4priority
- CVE-2020-0884A spoofing vulnerability exists in Microsoft Visual Studio as it includes a reply URL that is not secured by SSL, aka…Microsoft · Microsoft Visual Studio 2017 version 15.9 (includes 15.1 - 15.8)T1040Network SniffingT1528Steal Application Access TokenMITRE CTID mapping of the CVE · primary impact1.7%Top 23%15.4priority