Threaticon
Toggle sidebar

You're viewing a limited, public preview. Log in for full access.

Log in User Guide
Log in Get started
Detection Strategies DET0185 — Behavioral Detection Strategy for Use Alternate Authentication Material: Application Access Token (T1550.001)
DET0185

Behavioral Detection Strategy for Use Alternate Authentication Material: Application Access Token (T1550.001)

5 analytic(s) · 1 technique(s) detected

Analytics

5
AN0526 Analytic 0526
IaaS

Use of AWS STS or GCP IAM APIs to request temporary tokens or federation sessions inconsistent with normal account activity, including from unexpected principals or regions.

AWS:CloudTrail AssumeRole, GetFederationToken, GetSessionToken AWS:CloudTrail sts:GetFederationToken
[GeoIPDistanceThreshold] Distance between token creation and resource use locations
[RoleScope] Limit scope of acceptable role assumptions by account type
AN0527 Analytic 0527
Identity Provider

OAuth or SAML access tokens reused across multiple sessions or clients without corresponding MFA or login activity.

azure:signinlogs TokenIssued, RefreshTokenUsed m365:unified Delegated permission grants without user login event
[MFAEnforcement] Ensure MFA context exists prior to token issuance
[TokenReuseWindow] Maximum acceptable window for refresh token reuse
AN0528 Analytic 0528
SaaS

Application access tokens used to call APIs (e.g., Google Workspace, Salesforce) without interactive logins, often with unusual scopes or elevated permissions.

saas:googleworkspace OAuthTokenGranted, APIRequest saas:salesforce API login using access_token without login history
[ApplicationScopeAllowlist] Restrict allowed API scopes for enterprise applications
[TokenLifetime] Threshold for detecting unusually long-lived tokens
AN0529 Analytic 0529
Office Suite

OAuth token usage for Exchange Online or SharePoint API access without preceding login or from unauthorized clients.

m365:unified OAuthTokenIssued, FileAccessed, MailItemsAccessed
[ClientAppIDWhitelist] Restrict trusted Office apps authorized to request tokens
AN0530 Analytic 0530
Containers

Compromised service account tokens mounted inside containers and reused for external API calls or lateral movement across services.

kubernetes:apiserver serviceAccount token used in API requests not tied to workload identity AWS:CloudTrail AssumeRoleWithWebIdentity
[NamespaceScope] Restrict token use to specific namespaces or workloads

Detected Techniques

1

Details

MITRE ID
DET0185
STIX ID
x-mitre-detection-strategy--afdf49f9-905d-49e4-9e42-5726f35e87e4
Analytics
5
Techniques Detected
1
By Tactic
Lateral Movement
1
Leaving Threaticon

This link opens an external site that isn't part of the platform.