{"source_checked_on":"2026-10-19","schema_version":1,"key":"enterprise/T1528","id":"T1528","name":"Steal Application Access Token","domain":"enterprise","reviewed_on":"2026-09-28","source_url":"https://attack.mitre.org/techniques/T1528","source_file":{"file":"enterprise.json","url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/20664a889568dce884a1dac0ec7b12ae3a199f51/enterprise-attack/enterprise-attack-20.0.json","sha256":"81113ba98afa2928f3dcff62022539f7ce30c315c32e14422f11ff95ce534352","bytes":55271014},"source_object_sha256":"e5a31bc3d05e8b262b503da8501e65f74185174289cdad3300e8bed378d1ec11","description":"Adversaries can steal application access tokens as a means of acquiring credentials to access remote systems and resources.\n\nApplication access tokens are used to make authorized API requests on behalf of a user or service and are commonly used as a way to access resources in cloud and container-based applications and software-as-a-service (SaaS).(Citation: Auth0 - Why You Should Always Use Access Tokens to Secure APIs Sept 2019)  Adversaries who steal account API tokens in cloud and containerized environments may be able to access data and perform actions with the permissions of these accounts, which can lead to privilege escalation and further compromise of the environment.\n\nFor example, in Kubernetes environments, processes running inside a container may communicate with the Kubernetes API server using service account tokens. If a container is compromised, an adversary may be able to steal the container’s token and thereby gain access to Kubernetes API commands.(Citation: Kubernetes Service Accounts)  \n\nSimilarly, instances within continuous-development / continuous-integration (CI/CD) pipelines will often use API tokens to authenticate to other services for testing and deployment.(Citation: Cider Security Top 10 CICD Security Risks) If these pipelines are compromised, adversaries may be able to steal these tokens and leverage their privileges. \n\nIn Azure, an adversary who compromises a resource with an attached Managed Identity, such as an Azure VM, can request short-lived tokens through the Azure Instance Metadata Service (IMDS). These tokens can then facilitate unauthorized actions or further access to other Azure services, bypassing typical credential-based authentication.(Citation: Entra Managed Identities 2025)(Citation: SpecterOps Managed Identity 2022)\n\nToken theft can also occur through social engineering, in which case user action may be required to grant access. OAuth is one commonly implemented framework that issues tokens to users for access to systems. An application desiring access to cloud-based services or protected APIs can gain entry using OAuth 2.0 through a variety of authorization protocols. An example commonly-used sequence is Microsoft's Authorization Code Grant flow.(Citation: Microsoft Identity Platform Protocols May 2019)(Citation: Microsoft - OAuth Code Authorization flow - June 2019) An OAuth access token enables a third-party application to interact with resources containing user data in the ways requested by the application without obtaining user credentials. \n \nAdversaries can leverage OAuth authorization by constructing a malicious application designed to be granted access to resources with the target user's OAuth token.(Citation: Amnesty OAuth Phishing Attacks, August 2019)(Citation: Trend Micro Pawn Storm OAuth 2017) The adversary will need to complete registration of their application with the authorization server, for example Microsoft Identity Platform using Azure Portal, the Visual Studio IDE, the command-line interface, PowerShell, or REST API calls.(Citation: Microsoft - Azure AD App Registration - May 2019) Then, they can send a [Spearphishing Link](https://attack.mitre.org/techniques/T1566/002) to the target user to entice them to grant access to the application. Once the OAuth access token is granted, the application can gain potentially long-term access to features of the user account through [Application Access Token](https://attack.mitre.org/techniques/T1550/001).(Citation: Microsoft - Azure AD Identity Tokens - Aug 2019)\n\nApplication access tokens may function within a limited lifetime, limiting how long an adversary can utilize the stolen token. However, in some cases, adversaries can also steal application refresh tokens(Citation: Auth0 Understanding Refresh Tokens), allowing them to obtain new access tokens without prompting the user.  ","references":[{"source_name":"mitre-attack","url":"https://attack.mitre.org/techniques/T1528","external_id":"T1528"},{"source_name":"Amnesty OAuth Phishing Attacks, August 2019","description":"Amnesty International. (2019, August 16). Evolving Phishing Attacks Targeting Journalists and Human Rights Defenders from the Middle-East and North Africa. Retrieved October 8, 2019.","url":"https://www.amnesty.org/en/latest/research/2019/08/evolving-phishing-attacks-targeting-journalists-and-human-rights-defenders-from-the-middle-east-and-north-africa/"},{"source_name":"SpecterOps Managed Identity 2022","description":"Andy Robbins. (2022, June 6). Managed Identity Attack Paths, Part 1: Automation Accounts. Retrieved March 18, 2025.","url":"https://posts.specterops.io/managed-identity-attack-paths-part-1-automation-accounts-82667d17187a?gi=6a9daedade1c"},{"source_name":"Auth0 Understanding Refresh Tokens","description":"Auth0 Inc.. (n.d.). Understanding Refresh Tokens. Retrieved November 17, 2024.","url":"https://auth0.com/learn/refresh-tokens"},{"source_name":"Auth0 - Why You Should Always Use Access Tokens to Secure APIs Sept 2019","description":"Auth0. (n.d.). Why You Should Always Use Access Tokens to Secure APIs. Retrieved September 12, 2019.","url":"https://auth0.com/blog/why-should-use-accesstokens-to-secure-an-api/"},{"source_name":"Cider Security Top 10 CICD Security Risks","description":"Daniel Krivelevich and Omer Gil. (n.d.). Top 10 CI/CD Security Risks. Retrieved November 17, 2024.","url":"https://web.archive.org/web/20220316130828/https://www.cidersecurity.io/top-10-cicd-security-risks/"},{"source_name":"Trend Micro Pawn Storm OAuth 2017","description":"Hacquebord, F.. (2017, April 25). Pawn Storm Abuses Open Authentication in Advanced Social Engineering Attacks. Retrieved October 4, 2019.","url":"https://blog.trendmicro.com/trendlabs-security-intelligence/pawn-storm-abuses-open-authentication-advanced-social-engineering-attacks"},{"source_name":"Kubernetes Service Accounts","description":"Kubernetes. (2022, February 26). Configure Service Accounts for Pods. Retrieved April 1, 2022.","url":"https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/"},{"source_name":"Entra Managed Identities 2025","description":"Microsoft Entra. (2025, February 27). How to use managed identities for Azure resources on an Azure VM to acquire an access token. Retrieved March 18, 2025.","url":"https://learn.microsoft.com/en-us/entra/identity/managed-identities-azure-resources/how-to-use-vm-token"},{"source_name":"Microsoft - Azure AD Identity Tokens - Aug 2019","description":"Microsoft. (2019, August 29). Microsoft identity platform access tokens. Retrieved September 12, 2019.","url":"https://docs.microsoft.com/en-us/azure/active-directory/develop/access-tokens"},{"source_name":"Microsoft - Azure AD App Registration - May 2019","description":"Microsoft. (2019, May 8). Quickstart: Register an application with the Microsoft identity platform. Retrieved September 12, 2019.","url":"https://docs.microsoft.com/en-us/azure/active-directory/develop/quickstart-register-app"},{"source_name":"Microsoft - OAuth Code Authorization flow - June 2019","description":"Microsoft. (n.d.). Microsoft identity platform and OAuth 2.0 authorization code flow. Retrieved September 12, 2019.","url":"https://docs.microsoft.com/en-us/azure/active-directory/develop/v2-oauth2-auth-code-flow"},{"source_name":"Microsoft Identity Platform Protocols May 2019","description":"Microsoft. (n.d.). Retrieved September 12, 2019.","url":"https://docs.microsoft.com/en-us/azure/active-directory/develop/active-directory-v2-protocols"}],"platforms":["Containers","IaaS","Identity Provider","Office Suite","SaaS"],"environments":["cloud","containers","identity","onprem","saas"],"visibility":"source_mapped","visibility_note":null,"parent":null,"children":[],"telemetry":[{"id":"DC0038","name":"Application Log Content","page":"telemetry/DC0038/","kind":"attack_component","category":"Application and service audit","description":"Application-emitted audit or operational event content.","collection_focus":"Select the application event family required by the detection and document its native schema before normalization.","providers":[{"name":"Application audit logs","scope":"First-party service events and request/result fields; schema is application-specific.","source_id":"otel"},{"name":"OpenTelemetry-compatible log pipelines","scope":"Transport and normalization of emitted records; do not create missing audit instrumentation.","source_id":"otel"}],"configuration":["Enable the application audit category or instrument the owned lab application at the authorization/action boundary.","Define a schema with timestamp, service, actor, object, action, result and correlation ID. Export structured records through an authenticated collector.","Redact secrets and personal content, separate audit from debug logs, set retention and verify delivery during rotation/restart."],"configuration_example":null,"required_fields":["service","action","actor","record_count","result"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0038","collector":"illustrative-lab-collector","observation":{"service":"lab-portal","action":"export_requested","actor":"lab-reader","record_count":3,"result":"authorized"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Debug output is not necessarily a durable audit trail. Application developers must emit the relevant event; installing a log pipeline does not make an absent event exist.","sources":[{"id":"otel","title":"OpenTelemetry log data model","url":"https://opentelemetry.io/docs/specs/otel/logs/data-model/"}],"association":"attack_component","anomaly_design":"Per application, client and route: request rate, rare actions, failure ratios and unusual state transitions. Version changes, retries, health probes and seasonal load need separate baselines."},{"id":"DC0083","name":"Cloud Service Enumeration","page":"telemetry/DC0083/","kind":"attack_component","category":"Cloud control plane","description":"Enumeration of available cloud services or their configuration.","collection_focus":"Collect supported list/describe administrative APIs and retain caller and queried service scope; confirm read-event retention.","providers":[{"name":"AWS CloudTrail","scope":"Management-plane API activity; supported resource/data events require separate selectors.","source_id":"cloudtrail"},{"name":"Azure Monitor Activity Log","scope":"Azure resource control-plane operations; resource data-plane logs are separate.","source_id":"azure"},{"name":"Google Cloud Audit Logs","scope":"Admin Activity and other categories; configure Data Access where required.","source_id":"gcp"}],"configuration":["In the isolated account/project/subscription, route administrative audit logs to a protected destination with retention and access controls.","Select the relevant service, regions and read/write operations. Confirm whether the API below is a management or data event in the provider documentation.","Preserve actor/session, resource, request ID, service, operation, region and error details. Check delivery latency and avoid logging credentials or sensitive request bodies."],"configuration_example":null,"required_fields":["actor","service","action","result"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0083","collector":"illustrative-lab-collector","observation":{"actor":"lab-reader","service":"lab-monitoring","action":"list_resources","result":"success"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"AWS, Azure and Google expose different APIs and event schemas. An accepted API request does not prove the final resource state; join asynchronous outcomes and inventory.","sources":[{"id":"cloudtrail","title":"AWS CloudTrail event categories","url":"https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-events.html"},{"id":"ec2","title":"AWS EC2 API logging with CloudTrail","url":"https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/monitor-with-cloudtrail.html"},{"id":"azure","title":"Azure Monitor Activity Log","url":"https://learn.microsoft.com/en-us/azure/azure-monitor/fundamentals/activity-log"},{"id":"gcp","title":"Google Cloud Audit Logs","url":"https://docs.cloud.google.com/logging/docs/audit"}],"association":"attack_component","anomaly_design":"Per account, role, region and API: rare actions, new role-resource relationships, enumeration bursts and configuration changes. Separate deployment automation and organization-level administrative activity."},{"id":"DC0069","name":"Cloud Service Modification","page":"telemetry/DC0069/","kind":"attack_component","category":"Cloud control plane","description":"Changes to a managed cloud service configuration.","collection_focus":"Collect the service-specific update API and resulting configuration state; record account/project, actor and changed settings.","providers":[{"name":"AWS CloudTrail","scope":"Management-plane API activity; supported resource/data events require separate selectors.","source_id":"cloudtrail"},{"name":"Azure Monitor Activity Log","scope":"Azure resource control-plane operations; resource data-plane logs are separate.","source_id":"azure"},{"name":"Google Cloud Audit Logs","scope":"Admin Activity and other categories; configure Data Access where required.","source_id":"gcp"}],"configuration":["In the isolated account/project/subscription, route administrative audit logs to a protected destination with retention and access controls.","Select the relevant service, regions and read/write operations. Confirm whether the API below is a management or data event in the provider documentation.","Preserve actor/session, resource, request ID, service, operation, region and error details. Check delivery latency and avoid logging credentials or sensitive request bodies."],"configuration_example":null,"required_fields":["service","resource_id","attribute","before","after"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0069","collector":"illustrative-lab-collector","observation":{"service":"lab-audit-service","resource_id":"lab-service-1","attribute":"retention_days","before":7,"after":30}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"AWS, Azure and Google expose different APIs and event schemas. An accepted API request does not prove the final resource state; join asynchronous outcomes and inventory.","sources":[{"id":"cloudtrail","title":"AWS CloudTrail event categories","url":"https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-events.html"},{"id":"ec2","title":"AWS EC2 API logging with CloudTrail","url":"https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/monitor-with-cloudtrail.html"},{"id":"azure","title":"Azure Monitor Activity Log","url":"https://learn.microsoft.com/en-us/azure/azure-monitor/fundamentals/activity-log"},{"id":"gcp","title":"Google Cloud Audit Logs","url":"https://docs.cloud.google.com/logging/docs/audit"}],"association":"attack_component","anomaly_design":"Per account, role, region and API: rare actions, new role-resource relationships, enumeration bursts and configuration changes. Separate deployment automation and organization-level administrative activity."},{"id":"DC0025","name":"Cloud Storage Access","page":"telemetry/DC0025/","kind":"attack_component","category":"Cloud storage","description":"Access to stored cloud data, including reads and provider-supported access outcomes.","collection_focus":"Explicitly select relevant object-read data events; keep principal, key, request ID and result without object contents.","providers":[{"name":"AWS CloudTrail for S3","scope":"Bucket control-plane events and explicitly selected object data events.","source_id":"data_events"},{"name":"Google Cloud Audit Logs","scope":"Cloud Storage access requires the relevant audit category and permissions.","source_id":"gcp"},{"name":"Azure storage resource logs","scope":"Use resource-specific data-plane diagnostics; Activity Log alone does not describe blob reads.","source_id":"azure_storage"}],"configuration":["Choose only the lab buckets/containers and prefixes. Enable read/write data-event collection when object access is needed; management events alone are insufficient.","Keep administrative changes separately from object reads/writes. Set a cost budget and retention limit before enabling high-volume data logging.","Preserve object version/key, requesting identity, action, source address, result and request ID. Verify the collector actually receives one benign read and one benign write."],"configuration_example":{"label":"CloudTrail advanced event selector · example S3 prefix","language":"json","source_id":"data_events","content":"[\n  {\n    \"Name\": \"LabObjectReads\",\n    \"FieldSelectors\": [\n      {\n        \"Field\": \"eventCategory\",\n        \"Equals\": [\n          \"Data\"\n        ]\n      },\n      {\n        \"Field\": \"resources.type\",\n        \"Equals\": [\n          \"AWS::S3::Object\"\n        ]\n      },\n      {\n        \"Field\": \"resources.ARN\",\n        \"StartsWith\": [\n          \"arn:aws:s3:::lab-bucket/demo/\"\n        ]\n      },\n      {\n        \"Field\": \"readOnly\",\n        \"Equals\": [\n          \"true\"\n        ]\n      }\n    ]\n  }\n]","note":"Replace the placeholder with an owned lab bucket/prefix. Review costs and merge with required selectors; applying selectors can replace an existing selection. This does not enable management-event retention or object-write coverage."},"required_fields":["action","bucket","key","actor","result"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0025","collector":"illustrative-lab-collector","observation":{"action":"get_object","bucket":"lab-bucket","key":"demo.txt","actor":"lab-reader","result":"success"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Storage metadata, listing, object access and bucket administration are different operations. Do not equate a successful request with proven exfiltration or complete content visibility.","sources":[{"id":"data_events","title":"AWS CloudTrail data-event selectors","url":"https://docs.aws.amazon.com/awscloudtrail/latest/userguide/logging-data-events-with-cloudtrail.html"},{"id":"cloudtrail","title":"AWS CloudTrail event categories","url":"https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-events.html"},{"id":"gcp","title":"Google Cloud Audit Logs","url":"https://docs.cloud.google.com/logging/docs/audit"},{"id":"azure_storage","title":"Azure Blob Storage resource logging","url":"https://learn.microsoft.com/en-us/azure/storage/blobs/monitor-blob-storage"}],"association":"attack_component","anomaly_design":"Per principal and bucket/container: unusual object-read counts, transferred volume, new access pairs and bulk permission/deletion activity. Model backups, migrations and lifecycle policies separately."},{"id":"DC0055","name":"File Access","page":"telemetry/DC0055/","kind":"attack_component","category":"Windows and directory audit","description":"Access to file objects with user, process and access-right context.","collection_focus":"Enable Audit File System plus a narrow SACL on a lab directory; on Linux select path/syscall rules and join associated Audit records.","providers":[{"name":"Windows Security auditing","scope":"Policy-dependent account, object, task and logon records on the host that performs the operation.","source_id":"audit"}],"configuration":["Use a lab-only GPO under Computer Configuration → Windows Settings → Security Settings → Advanced Audit Policy Configuration. Enable the specific subcategory named below.","For object-level auditing, configure a narrow system access control list (SACL) on the test object in addition to policy. Do not audit an entire production directory by default.","Forward Security events from the responsible host or controller; retain subject and target identities, object identifiers, result and original XML. Confirm effective policy with auditpol /get /category:*."],"configuration_example":null,"required_fields":["path","access","actor","result"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0055","collector":"illustrative-lab-collector","observation":{"path":"C:\\Lab\\demo.txt","access":"read","actor":"LAB\\analyst","result":"success"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"A policy checkbox alone does not guarantee an event. Host role, SACL, success/failure selection and audit policy precedence matter. Directory changes may arrive as multiple records.","sources":[{"id":"audit","title":"Microsoft advanced security audit policy","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/advanced-security-audit-policy-settings"},{"id":"ad","title":"Microsoft Audit Directory Service Changes","url":"https://learn.microsoft.com/windows/security/threat-protection/auditing/audit-directory-service-changes"},{"id":"task","title":"Microsoft scheduled-task creation event 4698","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4698"}],"association":"attack_component","anomaly_design":"Per principal, host and object: unusual access/request rates, new principal-object relationships, and changes outside approved administration windows. Control for service accounts and scheduled directory maintenance."},{"id":"DC0002","name":"User Account Authentication","page":"telemetry/DC0002/","kind":"attack_component","category":"Identity and SaaS","description":"Authentication attempts and outcomes for a user or workload account.","collection_focus":"Collect successful and failed sign-ins, authentication method, application and conditional-access context; distinguish account validation from session creation.","providers":[{"name":"Microsoft Entra sign-in logs","scope":"Interactive, non-interactive and workload sign-in contexts, subject to tenant features and access.","source_id":"entra"},{"name":"Cloud identity service audit","scope":"Issuer-side credential and administrative events where the service supports them.","source_id":"cloudtrail"},{"name":"Application audit instrumentation","scope":"Application-side use of identities and sessions; design fields without raw tokens.","source_id":"otel"}],"configuration":["Enable/export the required identity sign-in and audit categories from the lab tenant to a protected destination. Document license, role and retention requirements.","Correlate issuance or administrative changes with later sign-ins using non-secret credential IDs, application IDs, user IDs and correlation IDs.","Exclude passwords, bearer tokens, cookies and private keys. Record success, failure, authentication context and application result separately."],"configuration_example":null,"required_fields":["account","application","result","reason","source_ip"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0002","collector":"illustrative-lab-collector","observation":{"account":"analyst@example.test","application":"lab-portal","result":"failure","reason":"invalid_credential","source_ip":"192.0.2.10"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"A token creation record is not evidence of token use; a sign-in is not a complete record of every resource access. Some provider-side data is unavailable to the customer.","sources":[{"id":"entra","title":"Microsoft Entra sign-in logs","url":"https://learn.microsoft.com/en-us/entra/identity/monitoring-health/concept-sign-ins"},{"id":"cloudtrail","title":"AWS CloudTrail event categories","url":"https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-events.html"},{"id":"otel","title":"OpenTelemetry log data model","url":"https://opentelemetry.io/docs/specs/otel/logs/data-model/"}],"association":"attack_component","anomaly_design":"Per identity and application: first-seen clients/resources, changes in authentication failures and session patterns, and unusual permission changes. Separate automation, travel, shared egress and identity-provider policy changes."}],"detection":{"key":"enterprise/T1528","id":"T1528","name":"Steal Application Access Token","domain":"enterprise","platforms":["Containers","IaaS","Identity Provider","Office Suite","SaaS"],"environments":["cloud","containers","identity","onprem","saas"],"source_url":"https://attack.mitre.org/techniques/T1528","technique_page":"techniques/enterprise/T1528/","page":"detections/enterprise/T1528/","status":"rule_source_available","counts":{"sigma":14,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":5,"live_validated":0},"sigma_rules":[{"id":"a6355fbe-f36f-45d8-8efc-ab42465cbc52","title":"Delegated Permissions Granted For All Users","status":"test","level":"high","logsource":{"product":"azure","service":"auditlogs"},"data_path":"data/detection-rules/a6355fbe-f36f-45d8-8efc-ab42465cbc52.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/cloud/azure/audit_logs/azure_app_delegated_permissions_all_users.yml","author":"Bailey Bercik '@baileybercik', Mark Morowczynski '@markmorow'","kind":"sigma"},{"id":"9b2cc4c4-2ad4-416d-8e8e-ee6aa6f5035a","title":"End User Consent","status":"test","level":"low","logsource":{"product":"azure","service":"auditlogs"},"data_path":"data/detection-rules/9b2cc4c4-2ad4-416d-8e8e-ee6aa6f5035a.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/cloud/azure/audit_logs/azure_app_end_user_consent.yml","author":"Bailey Bercik '@baileybercik', Mark Morowczynski '@markmorow'","kind":"sigma"},{"id":"7091372f-623c-4293-bc37-20c32b3492be","title":"End User Consent Blocked","status":"test","level":"medium","logsource":{"product":"azure","service":"auditlogs"},"data_path":"data/detection-rules/7091372f-623c-4293-bc37-20c32b3492be.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/cloud/azure/audit_logs/azure_app_end_user_consent_blocked.yml","author":"Bailey Bercik '@baileybercik', Mark Morowczynski '@markmorow'","kind":"sigma"},{"id":"c1d147ae-a951-48e5-8b41-dcd0170c7213","title":"App Granted Microsoft Permissions","status":"test","level":"high","logsource":{"product":"azure","service":"auditlogs"},"data_path":"data/detection-rules/c1d147ae-a951-48e5-8b41-dcd0170c7213.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/cloud/azure/audit_logs/azure_app_permissions_msft.yml","author":"Bailey Bercik '@baileybercik', Mark Morowczynski '@markmorow'","kind":"sigma"},{"id":"0055ad1f-be85-4798-83cf-a6da17c993b3","title":"Application URI Configuration Changes","status":"test","level":"high","logsource":{"product":"azure","service":"auditlogs"},"data_path":"data/detection-rules/0055ad1f-be85-4798-83cf-a6da17c993b3.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/cloud/azure/audit_logs/azure_app_uri_modifications.yml","author":"Mark Morowczynski '@markmorow', Bailey Bercik '@baileybercik'","kind":"sigma"},{"id":"6555754e-5e7f-4a67-ad1c-4041c413a007","title":"Anomalous Token","status":"test","level":"high","logsource":{"product":"azure","service":"riskdetection"},"data_path":"data/detection-rules/6555754e-5e7f-4a67-ad1c-4041c413a007.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/cloud/azure/identity_protection/azure_identity_protection_anomalous_token.yml","author":"Mark Morowczynski '@markmorow'","kind":"sigma"},{"id":"53acd925-2003-440d-a1f3-71a5253fe237","title":"Anonymous IP Address","status":"test","level":"high","logsource":{"product":"azure","service":"riskdetection"},"data_path":"data/detection-rules/53acd925-2003-440d-a1f3-71a5253fe237.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/cloud/azure/identity_protection/azure_identity_protection_anonymous_ip_address.yml","author":"Gloria Lee, '@gleeiamglo'","kind":"sigma"},{"id":"a84fc3b1-c9ce-4125-8e74-bdcdb24021f1","title":"Primary Refresh Token Access Attempt","status":"test","level":"high","logsource":{"product":"azure","service":"riskdetection"},"data_path":"data/detection-rules/a84fc3b1-c9ce-4125-8e74-bdcdb24021f1.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/cloud/azure/identity_protection/azure_identity_protection_prt_access.yml","author":"Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo'","kind":"sigma"},{"id":"25cde13e-8e20-4c29-b949-4e795b76f16f","title":"Suspicious Teams Application Related ObjectAcess Event","status":"test","level":"high","logsource":{"product":"windows","service":"security"},"data_path":"data/detection-rules/25cde13e-8e20-4c29-b949-4e795b76f16f.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/builtin/security/win_security_teams_suspicious_objectaccess.yml","author":"@SerkinValery","kind":"sigma"},{"id":"65744385-8541-44a6-8630-ffc824d7d4cc","title":"Microsoft Teams Sensitive File Access By Uncommon Applications","status":"test","level":"medium","logsource":{"product":"windows","category":"file_access","definition":"Requirements: Microsoft-Windows-Kernel-File ETW provider"},"data_path":"data/detection-rules/65744385-8541-44a6-8630-ffc824d7d4cc.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/file/file_access/file_access_win_teams_sensitive_files.yml","author":"@SerkinValery","kind":"sigma"},{"id":"0adc67e0-a68f-4ffd-9c43-28905aad5d6a","title":"HackTool - Koh Default Named Pipe","status":"test","level":"critical","logsource":{"product":"windows","category":"pipe_created","definition":"Note that you have to configure logging for Named Pipe Events in Sysmon config (Event ID 17 and Event ID 18). The basic configuration is in popular sysmon configuration (https://github.com/SwiftOnSecurity/sysmon-config), but it is worth verifying. You can also use other repo, e.g. https://github.com/Neo23x0/sysmon-config, https://github.com/olafhartong/sysmon-modular. How to test detection? You can check powershell script from this site https://svch0st.medium.com/guide-to-named-pipes-and-hunting-for-cobalt-strike-pipes-dc46b2c5f575"},"data_path":"data/detection-rules/0adc67e0-a68f-4ffd-9c43-28905aad5d6a.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/pipe_created/pipe_created_hktl_koh_default_pipe.yml","author":"Nasreddine Bencherchali (Nextron Systems)","kind":"sigma"},{"id":"8a4519e8-e64a-40b6-ae85-ba8ad2177559","title":"Renamed BrowserCore.EXE Execution","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/8a4519e8-e64a-40b6-ae85-ba8ad2177559.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_renamed_browsercore.yml","author":"Max Altgelt (Nextron Systems)","kind":"sigma"},{"id":"6d3a3952-6530-44a3-8554-cf17c116c615","title":"Potentially Suspicious JWT Token Search Via CLI","status":"test","level":"medium","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/6d3a3952-6530-44a3-8554-cf17c116c615.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_susp_jwt_token_search.yml","author":"Nasreddine Bencherchali (Nextron Systems), kagebunsher","kind":"sigma"},{"id":"d2eb17db-1d39-41dc-b57f-301f6512fa75","title":"Potentially Suspicious Command Targeting Teams Sensitive Files","status":"test","level":"medium","logsource":{"product":"windows","category":"process_creation"},"data_path":"data/detection-rules/d2eb17db-1d39-41dc-b57f-301f6512fa75.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_teams_suspicious_command_line_cred_access.yml","author":"@SerkinValery","kind":"sigma"}],"atlas_basic":[],"atlas_anomaly":[],"anomaly_types":[],"strategies":[{"id":"DET0515","name":"Detection Strategy for T1528 - Steal Application Access Token","url":"https://attack.mitre.org/detectionstrategies/DET0515","stix_id":"x-mitre-detection-strategy--58bdb4c6-510b-4ffc-9703-852614116ac8","relationship_id":"relationship--ba18f273-c399-46e3-be3e-205d1140f8d6","description":"","analytics":[{"id":"AN1423","name":"Analytic 1423","guidance":"Access and retrieval of container service account tokens followed by unauthorized API requests using those tokens to interact with the Kubernetes API server or internal services.","url":"https://attack.mitre.org/detectionstrategies/DET0515#AN1423","platforms":["Containers"],"tuning":[{"field":"TimeWindow","description":"Adjust based on how quickly tokens are expected to be used post-access"},{"field":"UserContext","description":"Tuning for known service accounts that legitimately access the API"}],"log_sources":[{"component_id":"DC0055","component":"File Access","name":"kubernetes:audit","channel":"GET or LIST requests to /var/run/secrets/kubernetes.io/serviceaccount/ followed by access to the Kubernetes API server","platforms":["Containers"],"analytic_id":"AN1423","source_url":"https://attack.mitre.org/detectionstrategies/DET0515#AN1423","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0055/"}]},{"id":"AN1424","name":"Analytic 1424","guidance":"Token retrieval from instance metadata endpoints such as AWS IMDS or Azure IMDS, followed by API usage using the obtained token from non-standard applications.","url":"https://attack.mitre.org/detectionstrategies/DET0515#AN1424","platforms":["IaaS"],"tuning":[{"field":"UserAgent","description":"May need tuning for known automation tools versus unexpected curl usage"},{"field":"TimeWindow","description":"Correlate retrieval and use of token within expected timeout window"}],"log_sources":[{"component_id":"DC0083","component":"Cloud Service Enumeration","name":"AWS:CloudTrail","channel":"GetInstanceIdentityDocument or IMDSv2 token requests","platforms":["IaaS"],"analytic_id":"AN1424","source_url":"https://attack.mitre.org/detectionstrategies/DET0515#AN1424","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0083/"},{"component_id":"DC0069","component":"Cloud Service Modification","name":"AWS:CloudTrail","channel":"Use of temporary credentials issued from IMDS access","platforms":["IaaS"],"analytic_id":"AN1424","source_url":"https://attack.mitre.org/detectionstrategies/DET0515#AN1424","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0069/"}]},{"id":"AN1425","name":"Analytic 1425","guidance":"Unusual OAuth app registration followed by user-granted OAuth tokens and subsequent high-privilege resource access via those tokens.","url":"https://attack.mitre.org/detectionstrategies/DET0515#AN1425","platforms":["Identity Provider"],"tuning":[{"field":"ConsentScope","description":"Tunable based on risky or privileged scopes in the environment"},{"field":"AppUserRatio","description":"Threshold of how many users have authorized a given app"}],"log_sources":[{"component_id":"DC0038","component":"Application Log Content","name":"azure:audit","channel":"App registrations or consent grants by abnormal users or at unusual times","platforms":["Identity Provider"],"analytic_id":"AN1425","source_url":"https://attack.mitre.org/detectionstrategies/DET0515#AN1425","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0038/"}]},{"id":"AN1426","name":"Analytic 1426","guidance":"Use of OAuth tokens by third-party apps to access user mail, calendar, or SharePoint resources where the token was granted recently or via spearphishing.","url":"https://attack.mitre.org/detectionstrategies/DET0515#AN1426","platforms":["Office Suite"],"tuning":[{"field":"ClientAppIDAllowList","description":"Defenders may allow known app IDs, flag unknowns"},{"field":"AccessVolumeThreshold","description":"Rate of resource access by a newly consented app"}],"log_sources":[{"component_id":"DC0025","component":"Cloud Storage Access","name":"m365:unified","channel":"App-only or delegated access patterns where client_id != known enterprise apps","platforms":["Office Suite"],"analytic_id":"AN1426","source_url":"https://attack.mitre.org/detectionstrategies/DET0515#AN1426","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0025/"}]},{"id":"AN1427","name":"Analytic 1427","guidance":"Programmatic access to user content via stolen access tokens in platforms like Slack, GitHub, Google Workspace — especially from new IPs, apps, or excessive resource access.","url":"https://attack.mitre.org/detectionstrategies/DET0515#AN1427","platforms":["SaaS"],"tuning":[{"field":"GeoVelocity","description":"Flag when token use appears across geographically distant logins"},{"field":"OAuthScopeSensitivity","description":"Weight certain scopes (admin, file.read) as higher risk"}],"log_sources":[{"component_id":"DC0002","component":"User Account Authentication","name":"saas:googleworkspace","channel":"Access via OAuth credentials with unusual scopes or from anomalous IPs","platforms":["SaaS"],"analytic_id":"AN1427","source_url":"https://attack.mitre.org/detectionstrategies/DET0515#AN1427","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0002/"},{"component_id":"DC0038","component":"Application Log Content","name":"saas:slack","channel":"OAuth token use by unknown app client_id accessing private channels or files","platforms":["SaaS"],"analytic_id":"AN1427","source_url":"https://attack.mitre.org/detectionstrategies/DET0515#AN1427","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0038/"}]}]}],"telemetry_references":[{"id":"DC0038","name":"Application Log Content","tag":"Application Log Content","page":"telemetry/DC0038/","kind":"attack_component"},{"id":"DC0083","name":"Cloud Service Enumeration","tag":"Cloud Service Enumeration","page":"telemetry/DC0083/","kind":"attack_component"},{"id":"DC0069","name":"Cloud Service Modification","tag":"Cloud Service Modification","page":"telemetry/DC0069/","kind":"attack_component"},{"id":"DC0025","name":"Cloud Storage Access","tag":"Cloud Storage Access","page":"telemetry/DC0025/","kind":"attack_component"},{"id":"DC0055","name":"File Access","tag":"File Access","page":"telemetry/DC0055/","kind":"attack_component"},{"id":"DC0002","name":"User Account Authentication","tag":"User Account Authentication","page":"telemetry/DC0002/","kind":"attack_component"}],"visibility":"source_mapped","visibility_note":null,"tool_references":[{"id":"S0677","name":"AADInternals","page":"tools/S0677/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0683","name":"Peirates","page":"tools/S0683/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S9009","name":"TruffleHog","page":"tools/S9009/","kind":"attack_tool","bases":["attack_uses"],"guides":[]}],"related_parent":null,"article_url":"https://1200km.com/articles/read/2026/2026-04-20-malicious-activity-as-a-statistical-signal-a-detection-engineering-analysis-of-anomaly-bas-90df8b6dea12/","validation":{"source_join":"exact_ids","sigma_yaml":"parsed","backend_compilation":"not_run","live_telemetry":"not_run","detection_execution":"not_run"}},"tools":[{"id":"S0677","name":"AADInternals","page":"tools/S0677/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0683","name":"Peirates","page":"tools/S0683/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S9009","name":"TruffleHog","page":"tools/S9009/","kind":"attack_tool","bases":["attack_uses"],"guides":[]}],"software":[{"id":"S0677","name":"AADInternals","url":"https://attack.mitre.org/software/S0677","kind":"tool","description":"[AADInternals](https://attack.mitre.org/software/S0677) can steal users’ access tokens via phishing emails containing malicious links.(Citation: AADInternals Documentation)","relationship_id":"relationship--c620753b-17ad-43bd-ace3-f572ebcac644","references":[{"source_name":"AADInternals Documentation","description":"Dr. Nestori Syynimaa. (2018, October 25). AADInternals. Retrieved February 18, 2022.","url":"https://o365blog.com/aadinternals"}]},{"id":"S0683","name":"Peirates","url":"https://attack.mitre.org/software/S0683","kind":"tool","description":"[Peirates](https://attack.mitre.org/software/S0683) gathers Kubernetes service account tokens using a variety of techniques.(Citation: Peirates GitHub)","relationship_id":"relationship--c13ac561-878f-4119-b5b1-39994f7c25df","references":[{"source_name":"Peirates GitHub","description":"InGuardians. (2022, January 5). Peirates GitHub. Retrieved February 8, 2022.","url":"https://github.com/inguardians/peirates"}]},{"id":"S9008","name":"Shai-Hulud","url":"https://attack.mitre.org/software/S9008","kind":"malware","description":"[Shai-Hulud](https://attack.mitre.org/software/S9008) has stolen access tokens and API tokens from with CI/CD pipeline solutions and repositories.(Citation: Netskope Shai-Hulud November 2025)(Citation: Palo Alto Unit 42 Shai-Hulud November 2025)(Citation: Wiz Shai-Hulud September 2025)(Citation: Socket Shai-Hulud November 2025)","relationship_id":"relationship--9536b15f-5562-4f9c-9931-49a98315ced1","references":[{"source_name":"Netskope Shai-Hulud November 2025","description":"Gianpietro Cutolo. (2025, November 26). Shai-Hulud 2.0: Aggressive, Automated, and Fast Spreading. Retrieved April 9, 2026.","url":"https://www.netskope.com/blog/shai-hulud-2-0-aggressive-automated-one-of-fastest-spreading-npm-supply-chain-attacks-ever-observed"},{"source_name":"Palo Alto Unit 42 Shai-Hulud November 2025","description":"Justin Moore. (2025, November 25). \"Shai-Hulud\" Worm Compromises npm Ecosystem in Supply Chain Attack (Updated November 26). Retrieved April 9, 2026.","url":"https://unit42.paloaltonetworks.com/npm-supply-chain-attack/"},{"source_name":"Wiz Shai-Hulud September 2025","description":"Merav Bar, Rami McCarthy, Barak Sharoni. (2025, September 16). Shai-Hulud: Ongoing Package Supply Chain Worm Delivering Data-Stealing Malware. Retrieved April 9, 2026.","url":"https://www.wiz.io/blog/shai-hulud-npm-supply-chain-attack"},{"source_name":"Socket Shai-Hulud November 2025","description":"Socket Research Team. (2025, November 24). Shai Hulud Strikes Again (v2). Retrieved April 9, 2026.","url":"https://socket.dev/blog/shai-hulud-strikes-again-v2"}]},{"id":"S9009","name":"TruffleHog","url":"https://attack.mitre.org/software/S9009","kind":"tool","description":"[TruffleHog](https://attack.mitre.org/software/S9009) has gathered access tokens and API tokens from CI/CD pipeline solutions and repositories.(Citation: Black Hills Information Security TruffleHog January 2024)","relationship_id":"relationship--aea68064-afb4-4748-9b7b-f10113f347ab","references":[{"source_name":"Black Hills Information Security TruffleHog January 2024","description":"Chris Traynor. (2024, January 18). Rooting For Secrets with TruffleHog. Retrieved April 15, 2026.","url":"https://www.blackhillsinfosec.com/rooting-for-secrets-with-trufflehog/"}]},{"id":"S9041","name":"TeamPCP Cloud Stealer","url":"https://attack.mitre.org/software/S9041","kind":"malware","description":"[TeamPCP Cloud Stealer](https://attack.mitre.org/software/S9041) can read runner.worker process memory to extract plaintext tokens.(Citation: Palo Alto TeamPCP MAR 2026)(Citation: Sysdig TeamPCP MAR 2026)(Citation: Wiz TeamPCP KICS MAR 2026)(Citation: Palo Alto TeamPCP MAR 2026)(Citation: FBI TeamPCP JUL 2026)(Citation: Google AI Threat Tracker MAY 2026)","relationship_id":"relationship--89b67f65-a828-4786-89c3-9276564fa3ae","references":[{"source_name":"FBI TeamPCP JUL 2026","description":"FBI. (2026, July 2). Cyber Criminal Group TeamPCP. Retrieved July 7, 2026.","url":"https://www.ic3.gov/CSA/2026/260702.pdf"},{"source_name":"Google AI Threat Tracker MAY 2026","description":"Google Threat Intelligence Group. (2026, May 11). GTIG AI Threat Tracker: Adversaries Leverage AI for Vulnerability Exploitation, Augmented Operations, and Initial Access. Retrieved July 7, 2026.","url":"https://cloud.google.com/blog/topics/threat-intelligence/ai-vulnerability-exploitation-initial-access"},{"source_name":"Wiz TeamPCP KICS MAR 2026","description":"McCarthy, R., Haughom, J., Read, B. (2026, March 23). KICS GitHub Action Compromised: TeamPCP Strikes Again in Supply Chain Attack. Retrieved July 1, 2026.","url":"https://www.wiz.io/blog/teampcp-attack-kics-github-action"},{"source_name":"Sysdig TeamPCP MAR 2026","description":"Sysdig Threat Research Team. (2026, March 23). TeamPCP expands: Supply chain compromise spreads from Trivy to Checkmarx GitHub Actions. Retrieved July 1, 2026.","url":"https://www.sysdig.com/blog/teampcp-expands-supply-chain-compromise-spreads-from-trivy-to-checkmarx-github-actions"},{"source_name":"Palo Alto TeamPCP MAR 2026","description":"Unit 42. (2026, March 31). Weaponizing the Protectors: TeamPCP’s Multi-Stage Supply Chain Attack on Security Infrastructure. Retrieved July 1, 2026.","url":"https://unit42.paloaltonetworks.com/teampcp-supply-chain-attacks/"}]},{"id":"S9042","name":"CanisterWorm","url":"https://attack.mitre.org/software/S9042","kind":"malware","description":"[CanisterWorm](https://attack.mitre.org/software/S9042) has gathered cloud access tokens.(Citation: FBI TeamPCP JUL 2026)","relationship_id":"relationship--24775c92-6293-4658-9d9b-3a9abd99b413","references":[{"source_name":"FBI TeamPCP JUL 2026","description":"FBI. (2026, July 2). Cyber Criminal Group TeamPCP. Retrieved July 7, 2026.","url":"https://www.ic3.gov/CSA/2026/260702.pdf"}]},{"id":"S9043","name":"Mini Shai-Hulud","url":"https://attack.mitre.org/software/S9043","kind":"malware","description":"[Mini Shai-Hulud](https://attack.mitre.org/software/S9043) has stolen application access tokens and other tokens to include those associated with CI/CD.(Citation: Wiz Mini Shai-Hulud MAY 2026)(Citation: Trend Micro TeamPCP MAY 2026)(Citation: Hunt.io TeamPCP Toolkit MAY 2026)(Citation: Phoenix TeamPCP 20 MAY 2026)(Citation: Flashpoint Mini Shai-Hulud MAY 2026)","relationship_id":"relationship--24bcb5b8-8416-490e-9b09-9b98cd2fb663","references":[{"source_name":"Flashpoint Mini Shai-Hulud MAY 2026","description":"Flashpoint. (2026, May 28). The Mini Shai-Hulud Worm and the New Era of CI/CD Exploitation. Retrieved July 16, 2026.","url":"https://flashpoint.io/blog/mini-shai-hulud-worm-new-era-ci-cd-exploitation/"},{"source_name":"Hunt.io TeamPCP Toolkit MAY 2026","description":"Hunt.io. (2026, May 14). How TeamPCP's Python Toolkit Survives a C2 Takedown: FIRESCALE, GitHub, and the Victim's Own Account. Retrieved July 16, 2026.","url":"https://hunt.io/blog/teampcp-python-toolkit-firescale-github-c2-takedown"},{"source_name":"Wiz Mini Shai-Hulud MAY 2026","description":"McCarthy, R., Cohen, A., and Read, B. (2026, May 12). Mini Shai-Hulud Strikes Again: TanStack + more npm Packages Compromised. Retrieved July 16, 2026.","url":"https://www.wiz.io/blog/mini-shai-hulud-strikes-again-tanstack-more-npm-packages-compromised"},{"source_name":"Trend Micro TeamPCP MAY 2026","description":"Santos, J. and Navato, J.R. (2026, May 13). Analyzing TeamPCP’s Supply Chain Attacks: Checkmarx KICS and elementary-data in CI/CD Credential Theft. Retrieved July 16, 2026.","url":"https://www.trendmicro.com/en_us/research/26/e/analyzing-teampcp-supply-chain-attacks.html"},{"source_name":"Phoenix TeamPCP 20 MAY 2026","description":"Webb, M. (2026, May 20). TeamPCP Wave Four: GitHub Breach via Poisoned VS Code Extension, durabletask PyPI Worm, and ~4,000 Internal Repositories Exfiltrated. Retrieved July 16, 2026.","url":"https://phoenix.security/teampcp-github-breach-durabletask-pypi-supply-chain-wave-four-2026/"}]},{"id":"S9044","name":"Kali365","url":"https://attack.mitre.org/software/S9044","kind":"malware","description":"[Kali365](https://attack.mitre.org/software/S9044) has obtained OAuth access and refresh tokens by deceiving victims into completing actor-initiated device authorization requests, and intercepting authentication sessions with legitimate identity providers through adversary-in-the-middle reverse proxy infrastructure. (Citation: Artic Wolf Labs Kali365 Device Code April 2026)(Citation: Artic Wolf Kali365 Device Code OAuth June 2026)(Citation: FBI IC3 Alert I-052126 Kali365 May 2026)(Citation: SpyCloud Kali365 June 2026)","relationship_id":"relationship--5e9241dc-6c11-40d1-ada2-5a7c9f19dd57","references":[{"source_name":"Artic Wolf Labs Kali365 Device Code April 2026","description":"Artic Wolf Labs. (2026, April 24). Token Bingo: Don’t Let Your Code be the Winner. Retrieved July 30, 2026.","url":"https://arcticwolf.com/resources/blog/token-bingo-dont-let-your-code-be-the-winner/"},{"source_name":"Artic Wolf Kali365 Device Code OAuth June 2026","description":"Artic Wolf Labs. (2026, June 2). Retrieved July 30, 2026.","url":"https://arcticwolf.com/resources/blog/kali365-expands-into-aws-microsoft-okta-xerox-max-messenger/"},{"source_name":"FBI IC3 Alert I-052126 Kali365 May 2026","description":"Federal Bureau of Investigation. (2026, May 21). Alert Number: I-052126-PSA: Kali365 Phishing-as-a-Service Kit Hijacks Microsoft 365 Access Tokens. Retrieved July 30, 2026.","url":"https://www.ic3.gov/PSA/2026/PSA260521"},{"source_name":"SpyCloud Kali365 June 2026","description":"Trevor Hilligoss. (2026, June 11). Kali365: Anatomy of a Microsoft 365 Phishing-as-a-Service Kit – From Telegram Hype to FBI Takedown Theater. Retrieved July 30, 2026.","url":"https://spycloud.com/blog/kali365-anatomy-of-a-microsoft365-phishing-as-a-service-kit/"}]},{"id":"S9045","name":"BACKUPOSINT v9.0 APEX PREDATOR","url":"https://attack.mitre.org/software/S9045","kind":"malware","description":"[BACKUPOSINT v9.0 APEX PREDATOR](https://attack.mitre.org/software/S9045) has the ability to steal application tokens for CI/CD services to include Bamboo, Github, and Jenkins.(Citation: AI-Mexico-Govt-Compromise) ","relationship_id":"relationship--f7297025-27c7-40d3-a841-82c8001b42b7","references":[{"source_name":"AI-Mexico-Govt-Compromise","description":"Jay Deen. (2026, May). AI-Assisted Compromise of Mexican Water Utility with OT Implications. Retrieved September 2, 2026.","url":"https://5943619.hs-sites.com/hubfs/116-Whitepapers/dragos-2026-ai-mexico-water-attack-intel-brief.pdf"}]}],"actors":[{"id":"G0007","name":"APT28","url":"https://attack.mitre.org/groups/G0007","kind":"intrusion-set","description":"[APT28](https://attack.mitre.org/groups/G0007) has used several malicious applications to steal user OAuth access tokens including applications masquerading as \"Google Defender\" \"Google Email Protection,\" and \"Google Scanner\" for Gmail users. They also targeted Yahoo users with applications masquerading as \"Delivery Service\" and \"McAfee Email Protection\".(Citation: Trend Micro Pawn Storm OAuth 2017)","relationship_id":"relationship--d348102c-89dc-452a-b86d-2460928defaa","references":[{"source_name":"Trend Micro Pawn Storm OAuth 2017","description":"Hacquebord, F.. (2017, April 25). Pawn Storm Abuses Open Authentication in Advanced Social Engineering Attacks. Retrieved October 4, 2019.","url":"https://blog.trendmicro.com/trendlabs-security-intelligence/pawn-storm-abuses-open-authentication-advanced-social-engineering-attacks"}]},{"id":"G0016","name":"APT29","url":"https://attack.mitre.org/groups/G0016","kind":"intrusion-set","description":"[APT29](https://attack.mitre.org/groups/G0016) uses stolen tokens to access victim accounts, without needing a password.(Citation: NCSC et al APT29 2024)","relationship_id":"relationship--2a26d848-2dc2-4339-92e4-2ac707878f2e","references":[{"source_name":"NCSC et al APT29 2024","description":"UK National Cyber Security Center et al. (2024, February). SVR cyber actors adapt tactics for initial cloud access. Retrieved March 1, 2024.","url":"https://www.ic3.gov/Media/News/2024/240226.pdf"}]},{"id":"G1056","name":"TeamPCP","url":"https://attack.mitre.org/groups/G1056","kind":"intrusion-set","description":"[TeamPCP](https://attack.mitre.org/groups/G1056) has used malware to steal access tokens from targeted cloud and developer environments.(Citation: Wiz Trivy Compromise MAR 2026)(Citation: Aqua Security Blog Trivy Compromise APR 2026)(Citation: Palo Alto TeamPCP MAR 2026)(Citation: Trend Micro TeamPCP MAY 2026)(Citation: FBI TeamPCP JUL 2026)","relationship_id":"relationship--1b4f2be7-14c4-4933-9af5-a5f94b750337","references":[{"source_name":"Aqua Security Blog Trivy Compromise APR 2026","description":"Aqua Team. (2026, April 1). Update: Ongoing Investigation and Continued Remediation. Retrieved July 1, 2026.","url":"https://www.aquasec.com/blog/trivy-supply-chain-attack-what-you-need-to-know"},{"source_name":"FBI TeamPCP JUL 2026","description":"FBI. (2026, July 2). Cyber Criminal Group TeamPCP. Retrieved July 7, 2026.","url":"https://www.ic3.gov/CSA/2026/260702.pdf"},{"source_name":"Wiz Trivy Compromise MAR 2026","description":"McCarthy, R. (2026, March 20). Trivy Compromised: Everything You Need to Know about the Latest Supply Chain Attack. Retrieved July 1, 2026.","url":"https://www.wiz.io/blog/trivy-compromised-teampcp-supply-chain-attack"},{"source_name":"Trend Micro TeamPCP MAY 2026","description":"Santos, J. and Navato, J.R. (2026, May 13). Analyzing TeamPCP’s Supply Chain Attacks: Checkmarx KICS and elementary-data in CI/CD Credential Theft. Retrieved July 16, 2026.","url":"https://www.trendmicro.com/en_us/research/26/e/analyzing-teampcp-supply-chain-attacks.html"},{"source_name":"Palo Alto TeamPCP MAR 2026","description":"Unit 42. (2026, March 31). Weaponizing the Protectors: TeamPCP’s Multi-Stage Supply Chain Attack on Security Infrastructure. Retrieved July 1, 2026.","url":"https://unit42.paloaltonetworks.com/teampcp-supply-chain-attacks/"}]},{"id":"G1057","name":"ShinyHunters","url":"https://attack.mitre.org/groups/G1057","kind":"intrusion-set","description":"[ShinyHunters](https://attack.mitre.org/groups/G1057) has stolen valid OAuth credentials from DevOps personnel or a company GitHub repository.(Citation: Intel471_SH_Aug2021) Additionally, [ShinyHunters](https://attack.mitre.org/groups/G1057) has stolen application access tokens to access cloud services and to bypass authentication mechanisms.(Citation: SOCRadar_ShinyHunters_Mar2024)   ","relationship_id":"relationship--68501418-9bf5-4f7f-a29e-0c11111bf791","references":[{"source_name":"Intel471_SH_Aug2021","description":"Intel 471. (2021, August 23). Here’s how to guard your enterprise against ShinyHunters. Retrieved July 29, 2026.","url":"https://www.intel471.com/blog/shinyhunters-data-breach-mitre-attack"},{"source_name":"SOCRadar_ShinyHunters_Mar2024","description":"SOCRadar. (2024, March 18). Dark Web Profile: ShinyHunters. Retrieved May 18, 2026.","url":"https://socradar.io/dark-web-profile-shinyhunters/"}]}],"mitigations":[{"id":"M1017","name":"User Training","url":"https://attack.mitre.org/mitigations/M1017","kind":"course-of-action","description":"Users need to be trained to not authorize third-party applications they don’t recognize. The user should pay particular attention to the redirect URL: if the URL is a misspelled or convoluted sequence of words related to an expected service or SaaS application, the website is likely trying to spoof a legitimate service. Users should also be cautious about the permissions they are granting to apps. For example, offline access and access to read emails should excite higher suspicions because adversaries can utilize SaaS APIs to discover credentials and other sensitive communications.","relationship_id":"relationship--9c3d1701-b0ed-4a20-a864-d2681535cfa8","references":[]},{"id":"M1018","name":"User Account Management","url":"https://attack.mitre.org/mitigations/M1018","kind":"course-of-action","description":"Enforce role-based access control to limit accounts to the least privileges they require. A Cloud Access Security Broker (CASB) can be used to set usage policies and manage user permissions on cloud applications to prevent access to application access tokens. In Kubernetes applications, set “automountServiceAccountToken: false” in the YAML specification of pods that do not require access to service account tokens.(Citation: Kubernetes Hardening Guide)","relationship_id":"relationship--d3e90e1c-b669-4909-ae44-75bfe8bf89e8","references":[{"source_name":"Kubernetes Hardening Guide","description":"National Security Agency, Cybersecurity and Infrastructure Security Agency. (2022, March). Kubernetes Hardening Guide. Retrieved April 1, 2022.","url":"https://media.defense.gov/2022/Aug/29/2003066362/-1/-1/0/CTR_KUBERNETES_HARDENING_GUIDANCE_1.2_20220829.PDF"}]},{"id":"M1021","name":"Restrict Web-Based Content","url":"https://attack.mitre.org/mitigations/M1021","kind":"course-of-action","description":"Administrators can block end-user consent to OAuth applications, disabling users from authorizing third-party apps through OAuth 2.0 and forcing administrative consent for all requests. They can also block end-user registration of applications by their users, to reduce risk. A Cloud Access Security Broker can also be used to ban applications.\n\nAzure offers a couple of enterprise policy settings in the Azure Management Portal that may help:\n\n\"Users -> User settings -> App registrations: Users can register applications\" can be set to \"no\" to prevent users from registering new applications. \n\"Enterprise applications -> User settings -> Enterprise applications: Users can consent to apps accessing company data on their behalf\" can be set to \"no\" to prevent users from consenting to allow third-party multi-tenant applications","relationship_id":"relationship--25407fd4-3940-4446-9c17-6eebe902dbdf","references":[]},{"id":"M1047","name":"Audit","url":"https://attack.mitre.org/mitigations/M1047","kind":"course-of-action","description":"Administrators should audit all cloud and container accounts to ensure that they are necessary and that the permissions granted to them are appropriate.  Additionally, administrators should perform an audit of all OAuth applications and the permissions they have been granted to access organizational data. This should be done extensively on all applications in order to establish a baseline, followed up on with periodic audits of new or updated applications. Suspicious applications should be investigated and removed.","relationship_id":"relationship--4b5948b4-eba5-4af6-93d1-71b109167f62","references":[]}],"candidates":[{"id":"67aaf4cb-54ce-42e2-ab56-e0a9bcc089b1","name":"Azure - Functions code upload - Functions code injection via File Share modification to retrieve the Functions identity access token","platforms":["iaas:azure"],"method":"automated","executor":"powershell","elevation_required":false,"dependency_count":1,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1528/T1528.yaml","description":"This test injects code into an Azure Function (RCE) to perform Subscription Privilege Escalation by retrieving the identity access token of an Azure functions instance.\n\nAttack idea/reference: https://orca.security/resources/blog/azure-shared-key-authorization-exploitation/\n\nOnce executed, the \"https://changeme\" will retrieve the access token when the function app is executed on behalf of the tenant. The function may be triggered manually from authorized people, triggered in regular intervals, or in various other ways. The access token can then be used to perform further attack steps with the permissions that the function app holds (e.g. listening virtual machines).\n\nNote: \n- The Azure Function modified in this test must be hosted via Azure Files in a File Share (Info on storage considerations for Azure Function: https://learn.microsoft.com/en-us/azure/azure-functions/storage-considerations).\n- For Function code upload to Azure Functions that are hosted via Azure Blob storage, refer to T1528 \"Azure - Functions code upload - Functions code injection via Blob upload\".\n- The required input fields can be retrieved in a reconnaissance step in test T1619 \"Azure - Enumerate Storage Account Objects via Key-based authentication using Azure CLI\". The code of function apps may be inspected and prepared from the result of test T1530 \"Azure - Dump Azure Storage Account Objects via Azure CLI\".\n- Important: Change the https://changeme.net in code_to_insert_path to a self-controlled endpoint. This endpoint can be hosted e.g. as request bin via Pipedream to display the body of incoming POST requests.\n- The default injected code to retrieve the access token can be replaced by arbitrary other code. In this case: Replace the code defined in code_to_insert_path\n\nRequirements:\n- The test is intended to be executed in interactive mode (with -Interactive parameter) in order to complete the az login command when MFA is required.\n- The EntraID user must have the role \"Storage Account Contributor\", or a role with similar permissions.\n\nExecution options: Defined by the input field execution_option\n- insert_code: This option (1) downloads the existing funciton code into a tmp file, (2) injects the code from code_to_insert_path at the beginning of the file, and (3) uploads the tampered file to the targeted Azure Function code (Azure File Share File).\n- replace_file: This option uploads the function code defined in code_to_insert_path to the targeted Azure Function code (Azure File Share File).","inputs":{"storage_account_name":{"type":"string","default":"storage_account_name_example","description":"Name of storage account that is related to the Function"},"execution_option":{"type":"string","default":"insert_code","description":"Chooses execution option insert_code, or replace_file"},"file_share_name":{"type":"string","default":"file_share_name_example","description":"Name of the file share that is related to the Function"},"file_path":{"type":"path","default":"site/wwwroot/function_app.py","description":"Path to the Function file in the file share"},"code_to_insert_path":{"type":"path","default":"$PathToAtomicsFolder/T1528/src/code_to_insert.py","description":"The code that will be injected into the Function"}},"dependencies":[{"description":"Azure CLI must be installed"}],"source_definition_sha256":"39c0db6ca602e60767ed7f899f7de0e06d404800db3c3d131255d560bddaed2d"},{"id":"9a5352e4-56e5-45c2-9b3f-41a46d3b3a43","name":"Azure - Functions code upload - Functions code injection via Blob upload","platforms":["iaas:azure"],"method":"automated","executor":"powershell","elevation_required":false,"dependency_count":1,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1528/T1528.yaml","description":"This test injects code into an Azure Function (RCE).\n\nAttack idea/reference: https://orca.security/resources/blog/azure-shared-key-authorization-exploitation/\n\nSimilar to T1528 \"Azure - Functions code upload - Functions code injection to retrieve the Functions identity access token\", the depicted code injection scenario tampers the source code of Azure Functions to perform Subscription Privilege Escalation by retrieving the identity access token of an Azure functions instance. In this case, the prepared zip file (underlying package for a Function) is expected to contain the tampered function presented in src/code_to_insert.py. Note that the endpoint https://changeme.net needs to be adapted in your packed function code.\n\nNote:\n- The Azure Function modified in this test must be hosted via Azure Blob storage (Info on storage considerations for Azure Function: https://learn.microsoft.com/en-us/azure/azure-functions/storage-considerations). \n- For Function code upload to Azure Functions that are hosted via Azure Files in a File Share, refer to T1528 \"Azure - Functions code upload - Functions code injection to retrieve the Functions identity access token\".\n- The required input fields can be retrieved in a reconnaissance step in test T1619 \"Azure - Enumerate Storage Account Objects via Key-based authentication using Azure CLI\". The code of function apps may be inspected and prepared from the result of test T1530 \"Azure - Dump Azure Storage Account Objects via Azure CLI\".\n\nRequirements:\n- The test is intended to be executed in interactive mode (with -Interactive parameter) in order to complete the az login command when MFA is required.\n- The EntraID user must have the role \"Storage Account Contributor\", or a role with similar permissions.","inputs":{"storage_account_name":{"type":"string","default":"storage_account_name_example","description":"Name of storage account that is related to the Function"},"container_name":{"type":"string","default":"container_name_example","description":"Name of the container that contains the function blob"},"blob_name":{"type":"string","default":"blob_example","description":"Name of the function blob"},"file_path_blob":{"type":"path","default":"$env:temp/T1528_function_code.zip","description":"Path to the function code file to upload as blob"}},"dependencies":[{"description":"Azure CLI must be installed"}],"source_definition_sha256":"c98f9337451b8a7aa1d2f1964e21bf6ad31c00841c4bc6edd522b5b1dc3109cb"}],"simulation":{"atomic_status":"documented_candidate","lab_execution":"not_run","browser_attack_runner":false,"prerequisites":"Use disposable lab hosts and test accounts, explicit target allowlists, a clean snapshot, bounded egress and a restore plan. Review every candidate and dependency before any execution.","scenario":null},"validation":{"source_identity":"checked_against_pinned_source","relationship_join":"exact_ids_no_inheritance","page_contract":"automated_checks_required","sensor_capture":"not_run","detection_backend":"not_run","adversary_simulation":"not_run","independent_incident_fact_check":"not_performed"},"technique_links":{"T1566.002":"/ttp-simulation/techniques/enterprise/T1566.002/","T1550.001":"/ttp-simulation/techniques/enterprise/T1550.001/","T1528":"/ttp-simulation/techniques/enterprise/T1528/"},"synthetic":{"schema":"1200km.ttp.collection-fixture.v1","synthetic":true,"technique_key":"enterprise/T1528","purpose":"Collection/parser contract exercise, NOT a positive example or detection of this TTP.","events":[{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0038","collector":"illustrative-lab-collector","observation":{"service":"lab-portal","action":"export_requested","actor":"lab-reader","record_count":3,"result":"authorized"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0083","collector":"illustrative-lab-collector","observation":{"actor":"lab-reader","service":"lab-monitoring","action":"list_resources","result":"success"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0069","collector":"illustrative-lab-collector","observation":{"service":"lab-audit-service","resource_id":"lab-service-1","attribute":"retention_days","before":7,"after":30}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0025","collector":"illustrative-lab-collector","observation":{"action":"get_object","bucket":"lab-bucket","key":"demo.txt","actor":"lab-reader","result":"success"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0055","collector":"illustrative-lab-collector","observation":{"path":"C:\\Lab\\demo.txt","access":"read","actor":"LAB\\analyst","result":"success"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0002","collector":"illustrative-lab-collector","observation":{"account":"analyst@example.test","application":"lab-portal","result":"failure","reason":"invalid_credential","source_ip":"192.0.2.10"}}]}}