MITRE ATT&CK technique

Steal Application Access Token detection rulesT1528

Steal Application Access Token (T1528) is a MITRE ATT&CK technique in the Credential Access tactic. This page lists the 14 community-maintained Sigma detection rules in the library mapped to T1528 and its sub-techniques. Each rule includes its detection logic, log source, false positives and original YAML. These rules mainly target azure, windows.

T1528 on attack.mitre.org14 rules

Tactic

Credential Access

HackTool - Koh Default Named Pipe
critical
Detects creation of default named pipes used by the Koh tool
windows · pipe_created
Anomalous Token
high
Indicates that there are abnormal characteristics in the token such as an unusual token lifetime or a token that is played from an unfamiliar location.
azure
Anonymous IP Address
high
Indicates sign-ins from an anonymous IP address, for example, using an anonymous browser or VPN.
azure
App Granted Microsoft Permissions
high
Detects when an application is granted delegated or app role permissions for Microsoft Graph, Exchange, Sharepoint, or Azure AD
azure
Application URI Configuration Changes
high
Detects when a configuration change is made to an applications URI. URIs for domain names that no longer exist (dangling URIs), not using HTTPS, wildcards at the end of the domain, URIs that are no unique to that app, or URIs that point to domains you do not control should be investigated.
azure
Delegated Permissions Granted For All Users
high
Detects when highly privileged delegated permissions are granted on behalf of all users
azure
Primary Refresh Token Access Attempt
high
Indicates access attempt to the PRT resource which can be used to move laterally into an organization or perform credential theft
azure
Renamed BrowserCore.EXE Execution
high
Detects process creation with a renamed BrowserCore.exe (used to extract Azure tokens)
windows · process_creation
Suspicious Teams Application Related ObjectAcess Event
high
Detects an access to authentication tokens and accounts of Microsoft Teams desktop application.
windows
End User Consent Blocked
medium
Detects when end user consent is blocked due to risk-based consent.
azure
Microsoft Teams Sensitive File Access By Uncommon Applications
medium
Detects file access attempts to sensitive Microsoft teams files (leveldb, cookies) by an uncommon process.
windows · file_access
Potentially Suspicious Command Targeting Teams Sensitive Files
medium
Detects a commandline containing references to the Microsoft Teams database or cookies files from a process other than Teams. The database might contain authentication tokens and other sensitive information about the logged in accounts.
windows · process_creation
Potentially Suspicious JWT Token Search Via CLI
medium
Detects potentially suspicious search for JWT tokens via CLI by looking for the string "eyJ0eX" or "eyJhbG". JWT tokens are often used for access-tokens across various applications and services like Microsoft 365, Azure, AWS, Google Cloud, and others. Threat actors may search for these tokens to steal them for lateral movement or privilege escalation.
windows · process_creation
End User Consent
low
Detects when an end user consents to an application
azure

Top products

Tactic

HackTool - Koh Default Named Pipe

Anomalous Token

Anonymous IP Address

App Granted Microsoft Permissions

Application URI Configuration Changes

Delegated Permissions Granted For All Users

Primary Refresh Token Access Attempt

Renamed BrowserCore.EXE Execution

Suspicious Teams Application Related ObjectAcess Event

End User Consent Blocked

Microsoft Teams Sensitive File Access By Uncommon Applications

Potentially Suspicious Command Targeting Teams Sensitive Files

Potentially Suspicious JWT Token Search Via CLI

End User Consent