T1550.001Lateral Movement
Application Access Token
Adversaries may use stolen application access tokens to bypass the typical authentication process and access restricted accounts, information, or services on remote systems. These tokens are typically stolen from users or services and used in lieu of login credentials. Application access tokens are used to make authorized API requests on behalf of a user or service and are commonly used to…
CVEs1
In CISA KEVThe US Cybersecurity and Infrastructure Security Agency’s list of Known Exploited Vulnerabilities. A CVE is added when CISA has evidence that attackers are using it.0
Reports0
Detections
4 Sigma rules tagged T1550.001Application Access TokenT1550.0014 general rules
- AWS Console GetSigninToken Potential Abusemediumtest
- AWS Suspicious SAML Activitymediumtest
- AWS STS AssumeRole Misuselowtest
- AWS STS GetSessionToken Misuselowtest
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
CVEs linked to Application Access Token
1 CVE, by priority. Each link shows its badge.- CVE-2018-15801Authorization Bypass During JWT Issuer Validation with spring-securityMITRE CTID mapping of the CVE · follow-on activity0.7%Top 49%12.6priority