type: attack-pattern
spec_version: 2.1
id: attack-pattern--27960489-4e7f-461d-a62a-f5c0cb521e4a
created: 2019-08-30T12:55:58.607Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: yes
external_references: source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1527
external_id: T1527
source_name: Auth0 - Why You Should Always Use Access Tokens to Secure APIs Sept 2019
description: Auth0. (n.d.). Why You Should Always Use Access Tokens to Secure APIs. Retrieved September 12, 2019.
url: https://auth0.com/blog/why-should-use-accesstokens-to-secure-an-api/
source_name: Microsoft Identity Platform Access 2019
description: Cai, S., Flores, J., de Guzman, C., et. al.. (2019, August 27). Microsoft identity platform access tokens. Retrieved October 4, 2019.
url: https://docs.microsoft.com/en-us/azure/active-directory/develop/access-tokens
source_name: okta
description: okta. (n.d.). What Happens If Your JWT Is Stolen?. Retrieved September 12, 2019.
url: https://developer.okta.com/blog/2018/06/20/what-happens-if-your-jwt-is-stolen
source_name: Staaldraad Phishing with OAuth 2017
description: Stalmans, E.. (2017, August 2). Phishing with OAuth and o365/Azure. Retrieved October 4, 2019.
url: https://staaldraad.github.io/2017/08/02/o356-phishing-with-oauth/
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-10-24T17:48:32.784Z
name: Application Access Token
description: Adversaries may use application access tokens to bypass the typical authentication process and access restricted accounts, information, or services on remote systems. These tokens are typically stolen from users and used in lieu of login credentials.

Application access tokens are used to make authorized API requests on behalf of a user and are commonly used as a way to access resources in cloud-based applications and software-as-a-service (SaaS).(Citation: Auth0 - Why You Should Always Use Access Tokens to Secure APIs Sept 2019) OAuth is one commonly implemented framework that issues tokens to users for access to systems. These frameworks are used collaboratively to verify the user and determine what actions the user is allowed to perform. Once identity is established, the token allows actions to be authorized, without passing the actual credentials of the user. Therefore, compromise of the token can grant the adversary access to resources of other sites through a malicious application.(Citation: okta)

For example, with a cloud-based email service once an OAuth access token is granted to a malicious application, it can potentially gain long-term access to features of the user account if a "refresh" token enabling background access is awarded.(Citation: Microsoft Identity Platform Access 2019) With an OAuth access token an adversary can use the user-granted REST API to perform functions such as email searching and contact enumeration.(Citation: Staaldraad Phishing with OAuth 2017)

Compromised access tokens may be used as an initial step in compromising other services. For example, if a token grants access to a victim’s primary email, the adversary may be able to extend access to all other services which the target subscribes by triggering forgotten password routines. Direct API access through a token negates the effectiveness of a second authentication factor and may be immune to intuitive countermeasures like changing passwords. Access abuse over an API channel can be difficult to detect even from the service provider end, as the access can still align well with a legitimate workflow.

kill_chain_phases: kill_chain_name: mitre-attack
phase_name: defense-evasion
kill_chain_name: mitre-attack
phase_name: lateral-movement
x_mitre_attack_spec_version: 3.2.0
x_mitre_contributors: Mark Wee
Jeff Sakowicz, Microsoft Identity Developer Platform Services (IDPM Services)
Saisha Agrawal, Microsoft Threat Intelligent Center (MSTIC)
Shailesh Tiwary (Indian Army)
Jack Burns, HubSpot
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_is_subtechnique: no
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: SaaS
Office 365
x_mitre_version: 1.2