{"source_checked_on":"2026-10-19","schema_version":1,"key":"enterprise/T1697","id":"T1697","name":"Steal Application Specific Passwords","domain":"enterprise","reviewed_on":"2026-09-28","source_url":"https://attack.mitre.org/techniques/T1697","source_file":{"file":"enterprise.json","url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/20664a889568dce884a1dac0ec7b12ae3a199f51/enterprise-attack/enterprise-attack-20.0.json","sha256":"81113ba98afa2928f3dcff62022539f7ce30c315c32e14422f11ff95ce534352","bytes":55271014},"source_object_sha256":"b9ec8bd91e4c5421000481c459d0ce9e922e8cd95e2f1ae52a812255e4a9ecb6","description":"Adversaries may steal Application Specific Passwords (ASPs) to gain access to [Valid Accounts](https://attack.mitre.org/techniques/T1078), bypassing multifactor authentication (MFA) methods. ASPs are passwords typically used to give third-party applications or legacy devices (which do not support MFA methods) account access.(Citation: Application Specific Passwords)(Citation: Application Specific Passwords Push Sec) \n \nAn adversary may socially engineer a user into providing an ASP(Citation: UNC6293 ASP Creative Phishing Attack)(Citation: Application Specific Passwords Phishing) (using methods like [Phishing for Information](https://attack.mitre.org/techniques/T1598)), generate an ASP for an already compromised account,(Citation: Mandiant APT42-untangling)(Citation: TAG APT42) or obtain an ASP stored on a system. Afterward, adversaries may use the ASP to access [Valid Accounts](https://attack.mitre.org/techniques/T1078) and, in some cases, maintain [Persistence](https://attack.mitre.org/tactics/TA0003), bypassing any form of MFA set on the account. ","references":[{"source_name":"mitre-attack","url":"https://attack.mitre.org/techniques/T1697","external_id":"T1697"},{"source_name":"Application Specific Passwords","description":" Tomer Yahalom. (2024, August 14). App-Specific Passwords: Origins, Functionality, Security Risks and Mitigation. Retrieved September 17, 2026.","url":"https://astrix.security/learn/blog/app-specific-passwords-origins-functionality-security-risks/"},{"source_name":"Application Specific Passwords Push Sec","description":"Dan Green. (2025, June 26). App-Specific Password phishing: another novel way to get around passkeys and MFA. Retrieved September 17, 2026.","url":"https://pushsecurity.com/blog/app-specific-password-phishing"},{"source_name":"UNC6293 ASP Creative Phishing Attack","description":"Gabby Roncone, Wesley Shields. (2025, June 18). What’s in an ASP? Creative Phishing Attack on Prominent Academics and Critics of Russia. Retrieved September 17, 2026.","url":"https://cloud.google.com/blog/topics/threat-intelligence/creative-phishing-academics-critics-of-russia"},{"source_name":"TAG APT42","description":"Google Threat Analysis Group. (2024, August 14). Iranian backed group steps up phishing campaigns against Israel, U.S.. Retrieved October 9, 2024.","url":"https://blog.google/threat-analysis-group/iranian-backed-group-steps-up-phishing-campaigns-against-israel-us/"},{"source_name":"Application Specific Passwords Phishing","description":"John Scott-Railton, Rebekah Brown, Bill Marczak. (2025, June 18). Same Sea, New Phish | Russian Government-Linked Social Engineering Targets App-Specific Passwords. Retrieved September 22, 2026.","url":"https://citizenlab.ca/research/russian-government-linked-social-engineering-targets-app-specific-passwords/"},{"source_name":"Mandiant APT42-untangling","description":"Rozmann, O., et al. (2024, May 1). Uncharmed: Untangling Iran's APT42 Operations. Retrieved October 9, 2024.","url":"https://cloud.google.com/blog/topics/threat-intelligence/untangling-iran-apt42-operations"}],"platforms":["Office Suite","Identity Provider","SaaS"],"environments":["cloud","identity","onprem","saas"],"visibility":"source_mapped","visibility_note":null,"parent":null,"children":[],"telemetry":[{"id":"DC0038","name":"Application Log Content","page":"telemetry/DC0038/","kind":"attack_component","category":"Application and service audit","description":"Application-emitted audit or operational event content.","collection_focus":"Select the application event family required by the detection and document its native schema before normalization.","providers":[{"name":"Application audit logs","scope":"First-party service events and request/result fields; schema is application-specific.","source_id":"otel"},{"name":"OpenTelemetry-compatible log pipelines","scope":"Transport and normalization of emitted records; do not create missing audit instrumentation.","source_id":"otel"}],"configuration":["Enable the application audit category or instrument the owned lab application at the authorization/action boundary.","Define a schema with timestamp, service, actor, object, action, result and correlation ID. Export structured records through an authenticated collector.","Redact secrets and personal content, separate audit from debug logs, set retention and verify delivery during rotation/restart."],"configuration_example":null,"required_fields":["service","action","actor","record_count","result"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0038","collector":"illustrative-lab-collector","observation":{"service":"lab-portal","action":"export_requested","actor":"lab-reader","record_count":3,"result":"authorized"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Debug output is not necessarily a durable audit trail. Application developers must emit the relevant event; installing a log pipeline does not make an absent event exist.","sources":[{"id":"otel","title":"OpenTelemetry log data model","url":"https://opentelemetry.io/docs/specs/otel/logs/data-model/"}],"association":"attack_component","anomaly_design":"Per application, client and route: request rate, rare actions, failure ratios and unusual state transitions. Version changes, retries, health probes and seasonal load need separate baselines."},{"id":"DC0067","name":"Logon Session Creation","page":"telemetry/DC0067/","kind":"attack_component","category":"Windows and directory audit","description":"Creation of a logon session with account and logon-type context.","collection_focus":"Enable Audit Logon and collect successful session creation on the receiving host; join session/logon IDs rather than only account names.","providers":[{"name":"Windows Security auditing","scope":"Policy-dependent account, object, task and logon records on the host that performs the operation.","source_id":"audit"}],"configuration":["Use a lab-only GPO under Computer Configuration → Windows Settings → Security Settings → Advanced Audit Policy Configuration. Enable the specific subcategory named below.","For object-level auditing, configure a narrow system access control list (SACL) on the test object in addition to policy. Do not audit an entire production directory by default.","Forward Security events from the responsible host or controller; retain subject and target identities, object identifiers, result and original XML. Confirm effective policy with auditpol /get /category:*."],"configuration_example":null,"required_fields":["account","logon_id","logon_type","source_ip"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0067","collector":"illustrative-lab-collector","observation":{"account":"LAB\\analyst","logon_id":"0x12345","logon_type":3,"source_ip":"192.0.2.10"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"A policy checkbox alone does not guarantee an event. Host role, SACL, success/failure selection and audit policy precedence matter. Directory changes may arrive as multiple records.","sources":[{"id":"audit","title":"Microsoft advanced security audit policy","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/advanced-security-audit-policy-settings"},{"id":"ad","title":"Microsoft Audit Directory Service Changes","url":"https://learn.microsoft.com/windows/security/threat-protection/auditing/audit-directory-service-changes"},{"id":"task","title":"Microsoft scheduled-task creation event 4698","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4698"}],"association":"attack_component","anomaly_design":"Per principal, host and object: unusual access/request rates, new principal-object relationships, and changes outside approved administration windows. Control for service accounts and scheduled directory maintenance."},{"id":"DC0002","name":"User Account Authentication","page":"telemetry/DC0002/","kind":"attack_component","category":"Identity and SaaS","description":"Authentication attempts and outcomes for a user or workload account.","collection_focus":"Collect successful and failed sign-ins, authentication method, application and conditional-access context; distinguish account validation from session creation.","providers":[{"name":"Microsoft Entra sign-in logs","scope":"Interactive, non-interactive and workload sign-in contexts, subject to tenant features and access.","source_id":"entra"},{"name":"Cloud identity service audit","scope":"Issuer-side credential and administrative events where the service supports them.","source_id":"cloudtrail"},{"name":"Application audit instrumentation","scope":"Application-side use of identities and sessions; design fields without raw tokens.","source_id":"otel"}],"configuration":["Enable/export the required identity sign-in and audit categories from the lab tenant to a protected destination. Document license, role and retention requirements.","Correlate issuance or administrative changes with later sign-ins using non-secret credential IDs, application IDs, user IDs and correlation IDs.","Exclude passwords, bearer tokens, cookies and private keys. Record success, failure, authentication context and application result separately."],"configuration_example":null,"required_fields":["account","application","result","reason","source_ip"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0002","collector":"illustrative-lab-collector","observation":{"account":"analyst@example.test","application":"lab-portal","result":"failure","reason":"invalid_credential","source_ip":"192.0.2.10"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"A token creation record is not evidence of token use; a sign-in is not a complete record of every resource access. Some provider-side data is unavailable to the customer.","sources":[{"id":"entra","title":"Microsoft Entra sign-in logs","url":"https://learn.microsoft.com/en-us/entra/identity/monitoring-health/concept-sign-ins"},{"id":"cloudtrail","title":"AWS CloudTrail event categories","url":"https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-events.html"},{"id":"otel","title":"OpenTelemetry log data model","url":"https://opentelemetry.io/docs/specs/otel/logs/data-model/"}],"association":"attack_component","anomaly_design":"Per identity and application: first-seen clients/resources, changes in authentication failures and session patterns, and unusual permission changes. Separate automation, travel, shared egress and identity-provider policy changes."},{"id":"DC0010","name":"User Account Modification","page":"telemetry/DC0010/","kind":"attack_component","category":"Windows and directory audit","description":"Modification of an account attribute, policy or enabled state.","collection_focus":"Enable Audit User Account Management and retain the changed attributes and target account; correlate approved administrative requests.","providers":[{"name":"Windows Security auditing","scope":"Policy-dependent account, object, task and logon records on the host that performs the operation.","source_id":"audit"},{"name":"Active Directory domain controllers","scope":"Directory changes and authentication records; collect from the relevant controllers, not only endpoints.","source_id":"ad"}],"configuration":["Use a lab-only GPO under Computer Configuration → Windows Settings → Security Settings → Advanced Audit Policy Configuration. Enable the specific subcategory named below.","For object-level auditing, configure a narrow system access control list (SACL) on the test object in addition to policy. Do not audit an entire production directory by default.","Forward Security events from the responsible host or controller; retain subject and target identities, object identifiers, result and original XML. Confirm effective policy with auditpol /get /category:*."],"configuration_example":null,"required_fields":["target_account","attribute","before","after"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0010","collector":"illustrative-lab-collector","observation":{"target_account":"lab-temp","attribute":"enabled","before":false,"after":true}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"A policy checkbox alone does not guarantee an event. Host role, SACL, success/failure selection and audit policy precedence matter. Directory changes may arrive as multiple records.","sources":[{"id":"audit","title":"Microsoft advanced security audit policy","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/advanced-security-audit-policy-settings"},{"id":"ad","title":"Microsoft Audit Directory Service Changes","url":"https://learn.microsoft.com/windows/security/threat-protection/auditing/audit-directory-service-changes"},{"id":"task","title":"Microsoft scheduled-task creation event 4698","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4698"}],"association":"attack_component","anomaly_design":"Per principal, host and object: unusual access/request rates, new principal-object relationships, and changes outside approved administration windows. Control for service accounts and scheduled directory maintenance."}],"detection":{"key":"enterprise/T1697","id":"T1697","name":"Steal Application Specific Passwords","domain":"enterprise","platforms":["Office Suite","Identity Provider","SaaS"],"environments":["cloud","identity","onprem","saas"],"source_url":"https://attack.mitre.org/techniques/T1697","technique_page":"techniques/enterprise/T1697/","page":"detections/enterprise/T1697/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":3,"live_validated":0},"sigma_rules":[],"atlas_basic":[],"atlas_anomaly":[],"anomaly_types":[],"strategies":[{"id":"DET0926","name":"Suspicious Acquisition and Use of Application-Specific Passwords","url":"https://attack.mitre.org/detectionstrategies/DET0926","stix_id":"x-mitre-detection-strategy--cbb2c861-8f0c-45ac-9005-4346e2ff6617","relationship_id":"relationship--6a2e526d-bfe2-4a95-a28b-c622a20ce753","description":"","analytics":[{"id":"AN2077","name":"Analytic 2077","guidance":"Detect successful SaaS authentication through an application-specific or legacy credential mechanism from a source/client not previously associated with that account, correlated with new session establishment or subsequent access inconsistent with ApprovedASPUsage.","url":"https://attack.mitre.org/detectionstrategies/DET0926#AN2077","platforms":["SaaS"],"tuning":[{"field":"ApprovedASPUsage","description":"Approved user/application/use-case relationships for ASP authentication—for example, which user or service is expected to use an ASP with which application. Derive from documented integration workflows and service ownership. Broadening permitted relationships reduces FP but increases FN for abused legitimate credentials; narrowing them increases detection sensitivity and FP."}],"log_sources":[{"component_id":"DC0002","component":"User Account Authentication","name":"saas:audit ","channel":"Successful application-specific/legacy credential authentication where exposed ","platforms":["SaaS"],"analytic_id":"AN2077","source_url":"https://attack.mitre.org/detectionstrategies/DET0926#AN2077","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0002/"},{"component_id":"DC0010","component":"User Account Modification","name":"saas:audit","channel":"ASP creation/modification event where supported ","platforms":["SaaS"],"analytic_id":"AN2077","source_url":"https://attack.mitre.org/detectionstrategies/DET0926#AN2077","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0010/"},{"component_id":"DC0067","component":"Logon Session Creation","name":"saas:session ","channel":"New authenticated session associated with changed source/client context ","platforms":["SaaS"],"analytic_id":"AN2077","source_url":"https://attack.mitre.org/detectionstrategies/DET0926#AN2077","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0067/"}]},{"id":"AN2076","name":"Analytic 2076","guidance":"Detect successful Office Suite access using an authentication method that does not perform the account's expected MFA flow, correlated within ASPActivityWindow with first-seen client/application access, an anomalous source/device, or an ASP-related account credential change where available.","url":"https://attack.mitre.org/detectionstrategies/DET0926#AN2076","platforms":["Office Suite"],"tuning":[],"log_sources":[{"component_id":"DC0038","component":"Application Log Content","name":"m365:unified","channel":"Authentication/account audit event identifying app-password or applicable legacy-authentication activity ","platforms":["Office Suite"],"analytic_id":"AN2076","source_url":"https://attack.mitre.org/detectionstrategies/DET0926#AN2076","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0038/"},{"component_id":"DC0002","component":"User Account Authentication","name":"azure:signinlogs","channel":"Successful account authentication with authentication/client properties inconsistent with normal MFA-backed access ","platforms":["Office Suite"],"analytic_id":"AN2076","source_url":"https://attack.mitre.org/detectionstrategies/DET0926#AN2076","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0002/"},{"component_id":"DC0010","component":"User Account Modification","name":"idp:audit","channel":"ASP added/created where exposed by provider","platforms":["Office Suite"],"analytic_id":"AN2076","source_url":"https://attack.mitre.org/detectionstrategies/DET0926#AN2076","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0010/"}]},{"id":"AN2075","name":"Analytic 2075","guidance":"Detect creation of an application-specific password for a user account, correlated within ASPActivityWindow with authentication from a source, device, client, or location outside the account's established baseline, or followed by authentication using a legacy/non-MFA authentication path inconsistent with ApprovedASPUsage.","url":"https://attack.mitre.org/detectionstrategies/DET0926#AN2075","platforms":["Identity Provider"],"tuning":[{"field":"ASPActivityWindow","description":"Time window used to correlate application-specific password creation, modification, retrieval, or use with subsequent authentication activity. Derive from the normal delay between ASP administration and legitimate first use. Increasing the window captures delayed malicious use but increases FP from unrelated account activity; decreasing it reduces FP but may miss delayed adversary use (FN)."},{"field":"ApprovedASPUsers","description":"Users or roles authorized to create, manage, or use application-specific passwords. Derive from IAM policy, role assignments, and approved exception records. Broadening the list reduces FP but increases FN from compromised authorized accounts; narrowing it increases FP for legitimate ASP users but reduces FN."},{"field":"ApprovedASPApplications","description":"Applications, services, or integrations approved to authenticate using application-specific passwords. Derive from application inventory and IAM/integration configuration. Broadening the set reduces FP but may conceal unauthorized application use (FN); narrowing it increases FP when legitimate applications are omitted."},{"field":"ApprovedASPUsage","description":"Approved user/application/use-case relationships for ASP authentication—for example, which user or service is expected to use an ASP with which application. Derive from documented integration workflows and service ownership. Broadening permitted relationships reduces FP but increases FN for abused legitimate credentials; narrowing them increases detection sensitivity and FP."},{"field":"KnownDevices","description":"Devices or managed endpoints from which ASP-related account activity or authentication is expected. Derive from device inventory, endpoint management, and historical successful authentication. Broadening known-device criteria reduces FP but can suppress compromised devices; narrowing increases FP from new/rebuilt legitimate devices."},{"field":"KnownLocations","description":"Expected geographic, network, tenant, or organizational locations for the associated identity/application activity. Derive from historical authentication telemetry and organizational network architecture. Broadening accepted locations reduces travel/remote-work FP but increases FN; narrowing increases sensitivity but also FP."},{"field":"ExpectedAuthMethods","description":"Authentication methods normally associated with the account/application workflow. Derive from identity-provider policy and historical authentication telemetry. Broadening expected methods reduces FP but can hide fallback or weaker authentication abuse; narrowing increases FP when legitimate authentication methods change."},{"field":"ApprovedLegacyClients","description":"Legacy clients explicitly permitted to authenticate using ASP-compatible mechanisms. Derive from application inventory and documented compatibility exceptions. Adding clients reduces FP but increases the opportunity for malicious use to blend with approved legacy authentication; removing clients increases FP until legitimate dependencies are remediated."},{"field":"KnownSourceRanges","description":"Network ranges from which approved ASP-backed applications or services normally authenticate. Derive from service/network architecture and historical authentication sources. Broadening ranges reduces FP but increases FN for adversary activity originating within accepted infrastructure; narrowing improves discrimination but increases FP from legitimate infrastructure changes."}],"log_sources":[{"component_id":"DC0010","component":"User Account Modification","name":"idp:audit","channel":"Application-specific password created/added for account ","platforms":["Identity Provider"],"analytic_id":"AN2075","source_url":"https://attack.mitre.org/detectionstrategies/DET0926#AN2075","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0010/"},{"component_id":"DC0002","component":"User Account Authentication","name":"idp:authentication ","channel":"Successful authentication associated with legacy/application-specific credential flow ","platforms":["Identity Provider"],"analytic_id":"AN2075","source_url":"https://attack.mitre.org/detectionstrategies/DET0926#AN2075","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0002/"},{"component_id":"DC0067","component":"Logon Session Creation","name":"idp:session ","channel":"New session established from source/device inconsistent with account baseline ","platforms":["Identity Provider"],"analytic_id":"AN2075","source_url":"https://attack.mitre.org/detectionstrategies/DET0926#AN2075","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0067/"}]}]}],"telemetry_references":[{"id":"DC0038","name":"Application Log Content","tag":"Application Log Content","page":"telemetry/DC0038/","kind":"attack_component"},{"id":"DC0067","name":"Logon Session Creation","tag":"Logon Session Creation","page":"telemetry/DC0067/","kind":"attack_component"},{"id":"DC0002","name":"User Account Authentication","tag":"User Account Authentication","page":"telemetry/DC0002/","kind":"attack_component"},{"id":"DC0010","name":"User Account Modification","tag":"User Account Modification","page":"telemetry/DC0010/","kind":"attack_component"}],"visibility":"source_mapped","visibility_note":null,"tool_references":[],"related_parent":null,"article_url":"https://1200km.com/articles/read/2026/2026-04-20-malicious-activity-as-a-statistical-signal-a-detection-engineering-analysis-of-anomaly-bas-90df8b6dea12/","validation":{"source_join":"exact_ids","sigma_yaml":"parsed","backend_compilation":"not_run","live_telemetry":"not_run","detection_execution":"not_run"}},"tools":[],"software":[],"actors":[{"id":"G1044","name":"APT42","url":"https://attack.mitre.org/groups/G1044","kind":"intrusion-set","description":"[APT42](https://attack.mitre.org/groups/G1044) has stolen application specific passwords in order to bypass MFA requirements to include victim environments who leverage the Microsoft App Password feature. (Citation: Mandiant APT42-charms) ","relationship_id":"relationship--56c4a20a-81a1-4042-8a6f-2fef460de20a","references":[{"source_name":"Mandiant APT42-charms","description":"Mandiant. (n.d.). APT42: Crooked Charms, Cons and Compromises. Retrieved October 9, 2024.","url":"https://services.google.com/fh/files/misc/apt42-crooked-charms-cons-and-compromises.pdf"}]}],"mitigations":[{"id":"M1017","name":"User Training","url":"https://attack.mitre.org/mitigations/M1017","kind":"course-of-action","description":"ASPs can be obtained through social engineering, which your technique explicitly includes. Train users not to generate or disclose ASPs in response to unsolicited instructions.","relationship_id":"relationship--0dc82354-8b3b-47f7-9bf3-31f9928ae395","references":[]},{"id":"M1018","name":"User Account Management","url":"https://attack.mitre.org/mitigations/M1018","kind":"course-of-action","description":"Restrict which users may create/use ASPs; disable ASP creation where unnecessary; remove existing ASPs. Microsoft allows admins to disable creation and separately delete existing ASPs; Google administrators can view/revoke users' application-specific passwords.","relationship_id":"relationship--780da253-55c0-4557-bc43-0a425a6cff2f","references":[]},{"id":"M1036","name":"Account Use Policies","url":"https://attack.mitre.org/mitigations/M1036","kind":"course-of-action","description":"Restrict authentication paths/clients/locations through which accounts using legacy/app-password authentication can authenticate. This matters because an ASP that has been stolen shouldn't automatically have unrestricted account reach.","relationship_id":"relationship--715a2282-4496-44fc-94f4-1f2ab029047f","references":[]},{"id":"M1042","name":"Disable or Remove Feature or Program","url":"https://attack.mitre.org/mitigations/M1042","kind":"course-of-action","description":"Disable ASP functionality where modern authentication is available. Microsoft specifically supports disabling users' ability to create app passwords and recommends disabling legacy authentication so existing app passwords no longer work.","relationship_id":"relationship--6342f9f0-d7d7-4568-b5bb-33f775c0b0f2","references":[]}],"candidates":[],"simulation":{"atomic_status":"no_atomic_candidate","lab_execution":"not_run","browser_attack_runner":false,"prerequisites":"Use disposable lab hosts and test accounts, explicit target allowlists, a clean snapshot, bounded egress and a restore plan. Review every candidate and dependency before any execution.","scenario":null},"validation":{"source_identity":"checked_against_pinned_source","relationship_join":"exact_ids_no_inheritance","page_contract":"automated_checks_required","sensor_capture":"not_run","detection_backend":"not_run","adversary_simulation":"not_run","independent_incident_fact_check":"not_performed"},"technique_links":{"T1078":"/ttp-simulation/techniques/enterprise/T1078/","T1598":"/ttp-simulation/techniques/enterprise/T1598/","T1697":"/ttp-simulation/techniques/enterprise/T1697/"},"synthetic":{"schema":"1200km.ttp.collection-fixture.v1","synthetic":true,"technique_key":"enterprise/T1697","purpose":"Collection/parser contract exercise, NOT a positive example or detection of this TTP.","events":[{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0038","collector":"illustrative-lab-collector","observation":{"service":"lab-portal","action":"export_requested","actor":"lab-reader","record_count":3,"result":"authorized"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0067","collector":"illustrative-lab-collector","observation":{"account":"LAB\\analyst","logon_id":"0x12345","logon_type":3,"source_ip":"192.0.2.10"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0002","collector":"illustrative-lab-collector","observation":{"account":"analyst@example.test","application":"lab-portal","result":"failure","reason":"invalid_credential","source_ip":"192.0.2.10"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0010","collector":"illustrative-lab-collector","observation":{"target_account":"lab-temp","attribute":"enabled","before":false,"after":true}}]}}