T1550.001 — Application Access Token

Tactic: Lateral Movement · Platforms: Containers, IaaS, Identity Provider, Office Suite, SaaS

Adversaries may use stolen application access tokens to bypass the typical authentication process and access restricted accounts, information, or services on remote systems. These tokens are typically stolen from users or services and used in lieu of login credentials. Application access tokens…

Sub-technique of Use Alternate Authentication Material (T1550).

Sigma detection rules (5)

title: "T1550.001 Use Alternate Authentication Material: Application Access Token"
id: 4f703a82-b256-4174-967a-3682b64a1fe6
description: 'Behavioral Detection Strategy for Use Alternate Authentication Material: Application Access Token (T1550.001). (Retargeted to the cloudtrail AWS telemetry that actually captures this techniques behavior; see logsource below.) Tune using: GeoIPDistanceThreshold, RoleScope.'
references:
  - https://attack.mitre.org/techniques/T1550/001
author: Shahrukh Khan
date: 2026-02-21
license: MIT
tags:
  - attack.lateral-movement
  - attack.t1550.001

logsource:
  category: cloudtrail
  product: aws

detection:
  selection:
    eventSource: 'sts.amazonaws.com'
    eventName: 'AssumeRoleWithWebIdentity'

  condition: selection

falsepositives:
  - Legitimate OIDC-federated workloads such as GitHub Actions or Kubernetes service accounts assuming roles through a recognized identity provider.

level: medium

title: "T1550.001 Use Alternate Authentication Material: Application Access Token"
id: 8ab9075e-9b38-44a3-81a9-9c8086320e20
description: 'Behavioral Detection Strategy for Use Alternate Authentication Material: Application Access Token (T1550.001). (Data Component: Web Credential Usage; baseline tier: fallback.) Tune using: ApplicationScopeAllowlist, TokenLifetime.'
references:
  - https://attack.mitre.org/techniques/T1550/001
author: Shahrukh Khan
date: 2026-06-22
license: MIT
tags:
  - attack.lateral-movement
  - attack.t1550.001

logsource:
  product: saas
  service: googleworkspace

detection:
  selection:
    events.name: 'authorize'

  condition: selection

falsepositives:
  - Standard user consent to a new third-party application requesting API access for legitimate business use.

level: medium

title: "T1550.001 Use Alternate Authentication Material: Application Access Token"
id: 59cca1ae-8f40-49d0-b3ba-382cbc043e5e
description: 'Behavioral Detection Strategy for Use Alternate Authentication Material: Application Access Token (T1550.001). (Data Component: Web Credential Usage; baseline tier: fallback.) Tune using: MFAEnforcement, TokenReuseWindow.'
references:
  - https://attack.mitre.org/techniques/T1550/001
author: Shahrukh Khan
date: 2026-01-17
license: MIT
tags:
  - attack.lateral-movement
  - attack.t1550.001

logsource:
  product: azure
  service: signinlogs

detection:
  selection:
    ResultType: '0'
    AuthenticationRequirement: 'singleFactorAuthentication'
  selection_risk:
    RiskState: 'atRisk'
  condition: selection and selection_risk

falsepositives:
  - Risk engine false positives from a user traveling and signing in from a new but legitimate location without triggering MFA due to policy gaps.

level: high

title: "T1550.001 Use Alternate Authentication Material: Application Access Token"
id: 76a22dbb-f894-4d37-91ac-ad4a0a7f07d0
description: 'Behavioral Detection Strategy for Use Alternate Authentication Material: Application Access Token (T1550.001). (Data Component: Web Credential Usage; baseline tier: fallback.) Tune using: ClientAppIDWhitelist.'
references:
  - https://attack.mitre.org/techniques/T1550/001
author: Shahrukh Khan
date: 2026-03-27
license: MIT
tags:
  - attack.lateral-movement
  - attack.t1550.001

logsource:
  product: m365
  service: unified

detection:
  selection:
    Operation: 'UserLoggedIn'
  filter_new_client:
    ClientIP|cidr: '10.0.0.0/8'
  condition: selection and not filter_new_client

falsepositives:
  - Standard sign-ins from client applications not yet added to the approved allowlist; the unified log does not directly expose which credential type authenticated the session.

level: low

title: "T1550.001 Use Alternate Authentication Material: Application Access Token"
id: 57b234ef-1592-4006-8a61-3fc51bdf6e15
description: 'Behavioral Detection Strategy for Use Alternate Authentication Material: Application Access Token (T1550.001). (Data Component: Web Credential Usage; baseline tier: fallback.) Tune using: NamespaceScope.'
references:
  - https://attack.mitre.org/techniques/T1550/001
author: Shahrukh Khan
date: 2026-05-25
license: MIT
tags:
  - attack.lateral-movement
  - attack.t1550.001

logsource:
  product: kubernetes
  service: apiserver

detection:
  selection:
    user.username|startswith: 'system:serviceaccount:'
    verb:
      - 'create'
      - 'update'
      - 'delete'
    objectRef.resource:
      - 'secrets'
      - 'configmaps'
  selection_external_source:
    sourceIPs|cidr: '0.0.0.0/0'
  filter_cluster_internal:
    sourceIPs|cidr: '10.0.0.0/8'

  condition: selection and selection_external_source and not filter_cluster_internal

falsepositives:
  - Legitimate external CI or CD runners operating with a service account token from an allow-listed egress IP range.

level: high

Related sub-techniques

• T1550.002 Pass the Hash
• T1550.004 Web Session Cookie
• T1550.003 Pass the Ticket

Explore

• All Sigma rules for MITRE ATT&CK
• Sigma rule format guide
• Full T1550.001 intelligence — ATT&CK Intelligence View
• Official MITRE ATT&CK entry
• Built by Shahrukh Khan