Skip to content

T1528 Steal Application Access Token

Adversaries can steal application access tokens as a means of acquiring credentials to access remote systems and resources.

Application access tokens are used to make authorized API requests on behalf of a user or service and are commonly used as a way to access resources in cloud and container-based applications and software-as-a-service (SaaS).3 OAuth is one commonly implemented framework that issues tokens to users for access to systems. Adversaries who steal account API tokens in cloud and containerized environments may be able to access data and perform actions with the permissions of these accounts, which can lead to privilege escalation and further compromise of the environment.

In Kubernetes environments, processes running inside a container communicate with the Kubernetes API server using service account tokens. If a container is compromised, an attacker may be able to steal the container’s token and thereby gain access to Kubernetes API commands.5

Token theft can also occur through social engineering, in which case user action may be required to grant access. An application desiring access to cloud-based services or protected APIs can gain entry using OAuth 2.0 through a variety of authorization protocols. An example commonly-used sequence is Microsoft’s Authorization Code Grant flow.98 An OAuth access token enables a third-party application to interact with resources containing user data in the ways requested by the application without obtaining user credentials.

Adversaries can leverage OAuth authorization by constructing a malicious application designed to be granted access to resources with the target user’s OAuth token.14 The adversary will need to complete registration of their application with the authorization server, for example Microsoft Identity Platform using Azure Portal, the Visual Studio IDE, the command-line interface, PowerShell, or REST API calls.7 Then, they can send a Spearphishing Link to the target user to entice them to grant access to the application. Once the OAuth access token is granted, the application can gain potentially long-term access to features of the user account through Application Access Token.6

Application access tokens may function within a limited lifetime, limiting how long an adversary can utilize the stolen token. However, in some cases, adversaries can also steal application refresh tokens2, allowing them to obtain new access tokens without prompting the user.

Item Value
ID T1528
Sub-techniques
Tactics TA0006
Platforms Azure AD, Containers, Google Workspace, Office 365, SaaS
Version 1.2
Created 04 September 2019
Last Modified 21 April 2022

Procedure Examples

ID Name Description
S0677 AADInternals AADInternals can steal users’ access tokens via phishing emails containing malicious links.11
G0007 APT28 APT28 has used several malicious applications to steal user OAuth access tokens including applications masquerading as “Google Defender” “Google Email Protection,” and “Google Scanner” for Gmail users. They also targeted Yahoo users with applications masquerading as “Delivery Service” and “McAfee Email Protection”.4
S0683 Peirates Peirates gathers Kubernetes service account tokens using a variety of techniques.12

Mitigations

ID Mitigation Description
M1047 Audit Administrators should audit all cloud and container accounts to ensure that they are necessary and that the permissions granted to them are appropriate. Additionally, administrators should perform an audit of all OAuth applications and the permissions they have been granted to access organizational data. This should be done extensively on all applications in order to establish a baseline, followed up on with periodic audits of new or updated applications. Suspicious applications should be investigated and removed.
M1021 Restrict Web-Based Content Administrators can block end-user consent to OAuth applications, disabling users from authorizing third-party apps through OAuth 2.0 and forcing administrative consent for all requests. They can also block end-user registration of applications by their users, to reduce risk. A Cloud Access Security Broker can also be used to ban applications.
M1018 User Account Management Enforce role-based access control to limit accounts to the least privileges they require. A Cloud Access Security Broker (CASB) can be used to set usage policies and manage user permissions on cloud applications to prevent access to application access tokens. In Kubernetes applications, set “automountServiceAccountToken: false” in the YAML specification of pods that do not require access to service account tokens.10
M1017 User Training Users need to be trained to not authorize third-party applications they don’t recognize. The user should pay particular attention to the redirect URL: if the URL is a misspelled or convoluted sequence of words related to an expected service or SaaS application, the website is likely trying to spoof a legitimate service. Users should also be cautious about the permissions they are granting to apps. For example, offline access and access to read emails should excite higher suspicions because adversaries can utilize SaaS APIs to discover credentials and other sensitive communications.

Detection

ID Data Source Data Component
DS0002 User Account User Account Modification

References

  1. Amnesty International. (2019, August 16). Evolving Phishing Attacks Targeting Journalists and Human Rights Defenders from the Middle-East and North Africa. Retrieved October 8, 2019. ↩

  2. Auth0 Inc.. (n.d.). Understanding Refresh Tokens. Retrieved December 16, 2021. ↩

  3. Auth0. (n.d.). Why You Should Always Use Access Tokens to Secure APIs. Retrieved September 12, 2019. ↩

  4. Hacquebord, F.. (2017, April 25). Pawn Storm Abuses Open Authentication in Advanced Social Engineering Attacks. Retrieved October 4, 2019. ↩↩

  5. Kubernetes. (2022, February 26). Configure Service Accounts for Pods. Retrieved April 1, 2022. ↩

  6. Microsoft. (2019, August 29). Microsoft identity platform access tokens. Retrieved September 12, 2019. ↩

  7. Microsoft. (2019, May 8). Quickstart: Register an application with the Microsoft identity platform. Retrieved September 12, 2019. ↩

  8. Microsoft. (n.d.). Microsoft identity platform and OAuth 2.0 authorization code flow. Retrieved September 12, 2019. ↩

  9. Microsoft. (n.d.). Retrieved September 12, 2019. ↩

  10. National Security Agency, Cybersecurity and Infrastructure Security Agency. (2022, March). Kubernetes Hardening Guide. Retrieved April 1, 2022. ↩

  11. Dr. Nestori Syynimaa. (2018, October 25). AADInternals. Retrieved February 18, 2022. ↩

  12. InGuardians. (2022, January 5). Peirates GitHub. Retrieved February 8, 2022. ↩