T1528 — Steal Application Access Token

Tactic: Credential Access · Platforms: Containers, IaaS, Identity Provider, Office Suite, SaaS

Adversaries can steal application access tokens as a means of acquiring credentials to access remote systems and resources. Application access tokens are used to make authorized API requests on behalf of a user or service and are commonly used as a way to access resources in cloud and…

Sigma detection rules (5)

T1528 Steal Application Access Token

title: T1528 Steal Application Access Token
id: 74596f52-0f6b-4d22-abd4-f3e1a498ecc7
description: 'Detection Strategy for T1528 - Steal Application Access Token. (Retargeted to the cloudtrail AWS telemetry that actually captures this techniques behavior; see logsource below.) Tune using: UserAgent, TimeWindow.'
references:
  - https://attack.mitre.org/techniques/T1528
author: Shahrukh Khan
date: 2026-06-08
license: MIT
tags:
  - attack.credential-access
  - attack.t1528

logsource:
  category: cloudtrail
  product: aws

detection:
  selection_cognito:
    eventSource: 'cognito-identity.amazonaws.com'
    eventName:
      - 'GetOpenIdToken'
      - 'GetCredentialsForIdentity'
  selection_lambda_secrets:
    eventSource: 'lambda.amazonaws.com'
    eventName: 'GetFunction'
    userAgent|contains:
      - 'pacu'
      - 'cloudfox'
      - 'python-requests'

  condition: selection_cognito or selection_lambda_secrets

falsepositives:
  - Legitimate mobile or web application federated identity flows through Cognito, or engineers reviewing Lambda configuration through the standard console user agent.

level: high

T1528 Steal Application Access Token

title: T1528 Steal Application Access Token
id: 08131f80-b52f-4ba6-8b29-d4e17dc606ab
description: 'Detection Strategy for T1528 - Steal Application Access Token. (Data Component: User Account Authentication; baseline tier: fallback.) Tune using: GeoVelocity, OAuthScopeSensitivity.'
references:
  - https://attack.mitre.org/techniques/T1528
author: Shahrukh Khan
date: 2026-02-10
license: MIT
tags:
  - attack.credential-access
  - attack.t1528

logsource:
  product: saas
  service: googleworkspace

detection:
  selection_event:
    events.name: 'authorize'
  selection_scope:
    events.parameters.oauth_scopes|contains:
      - 'https://www.googleapis.com/auth/drive'
      - 'https://mail.google.com/'
      - 'https://www.googleapis.com/auth/admin.directory.user'

  condition: selection_event and selection_scope

falsepositives:
  - Legitimate third-party productivity or backup applications requesting broad Drive, Gmail, or directory scopes during normal user-initiated OAuth consent.

level: high

T1528 Steal Application Access Token

title: T1528 Steal Application Access Token
id: d8d14711-6cb2-4a36-81cf-0525465625c6
description: 'Detection Strategy for T1528 - Steal Application Access Token. (Data Component: Application Log Content; baseline tier: fallback.) Tune using: ConsentScope, AppUserRatio.'
references:
  - https://attack.mitre.org/techniques/T1528
author: Shahrukh Khan
date: 2026-01-02
license: MIT
tags:
  - attack.credential-access
  - attack.t1528

logsource:
  product: azure
  service: audit

detection:
  selection:
    OperationName: 'Consent to application'
  scope:
    TargetResources|contains:
      - 'Mail.Read'
      - 'Mail.ReadWrite'
      - 'Files.ReadWrite.All'
      - 'Directory.ReadWrite.All'

  condition: selection and scope

falsepositives:
  - Legitimate line-of-business application onboarding that requires broad mailbox or directory scopes with proper security review.

level: high

T1528 Steal Application Access Token

title: T1528 Steal Application Access Token
id: d50211d1-ed12-45d8-8215-22ef5777b717
description: 'Detection Strategy for T1528 - Steal Application Access Token. (Data Component: Cloud Storage Access; baseline tier: fallback.) Tune using: ClientAppIDAllowList, AccessVolumeThreshold.'
references:
  - https://attack.mitre.org/techniques/T1528
author: Shahrukh Khan
date: 2026-05-13
license: MIT
tags:
  - attack.credential-access
  - attack.t1528

logsource:
  product: m365
  service: unified

detection:
  selection:
    Operation:
      - 'FileDownloaded'
      - 'FileSyncDownloadedFull'
    Workload: 'SharePoint'

  condition: selection

falsepositives:
  - Normal OneDrive or SharePoint sync client activity by end users; distinguishing an OAuth-token-driven bulk download from normal sync requires a volume threshold across a time window that a single Sigma event cannot express.

level: medium

T1528 Steal Application Access Token

title: T1528 Steal Application Access Token
id: 7bc334b2-44a3-4344-9b91-5a09bc7310b5
description: 'Detection Strategy for T1528 - Steal Application Access Token. (Data Component: File Access; baseline tier: fallback.) Tune using: TimeWindow, UserContext.'
references:
  - https://attack.mitre.org/techniques/T1528
author: Shahrukh Khan
date: 2026-01-12
license: MIT
tags:
  - attack.credential-access
  - attack.t1528

logsource:
  product: kubernetes
  service: audit

detection:
  selection:
    verb: 'get'
    objectRef.resource: 'secrets'
    objectRef.name|contains: 'token'

  condition: selection

falsepositives:
  - Automation controllers and operators that legitimately read service account token secrets during normal reconciliation.

level: high

Explore