T1528 Steal Application Access Token — Detection Rules

Source-backed rule directory

• Delegated Permissions Granted For All Users · test · high · {"product":"azure","service":"auditlogs"}
• End User Consent · test · low · {"product":"azure","service":"auditlogs"}
• End User Consent Blocked · test · medium · {"product":"azure","service":"auditlogs"}
• App Granted Microsoft Permissions · test · high · {"product":"azure","service":"auditlogs"}
• Application URI Configuration Changes · test · high · {"product":"azure","service":"auditlogs"}
• Anomalous Token · test · high · {"product":"azure","service":"riskdetection"}
• Anonymous IP Address · test · high · {"product":"azure","service":"riskdetection"}
• Primary Refresh Token Access Attempt · test · high · {"product":"azure","service":"riskdetection"}
• Suspicious Teams Application Related ObjectAcess Event · test · high · {"product":"windows","service":"security"}
• Microsoft Teams Sensitive File Access By Uncommon Applications · test · medium · {"product":"windows","category":"file_access","definition":"Requirements: Microsoft-Windows-Kernel-File ETW provider"}
• HackTool - Koh Default Named Pipe · test · critical · {"product":"windows","category":"pipe_created","definition":"Note that you have to configure logging for Named Pipe Events in Sysmon config (Event ID 17 and Event ID 18). The basic configuration is in popular sysmon configuration (https://github.com/SwiftOnSecurity/sysmon-config), but it is worth verifying. You can also use other repo, e.g. https://github.com/Neo23x0/sysmon-config, https://github.com/olafhartong/sysmon-modular. How to test detection? You can check powershell script from this site https://svch0st.medium.com/guide-to-named-pipes-and-hunting-for-cobalt-strike-pipes-dc46b2c5f575"}
• Renamed BrowserCore.EXE Execution · test · high · {"category":"process_creation","product":"windows"}
• Potentially Suspicious JWT Token Search Via CLI · test · medium · {"category":"process_creation","product":"windows"}
• Potentially Suspicious Command Targeting Teams Sensitive Files · test · medium · {"product":"windows","category":"process_creation"}

Atlas deterministic concepts

No exact concept selected.

Anomaly models

No exact Atlas model in this snapshot.

ATT&CK analytic guidance

DET0515 Detection Strategy for T1528 - Steal Application Access Token

AN1423 Analytic 1423

Access and retrieval of container service account tokens followed by unauthorized API requests using those tokens to interact with the Kubernetes API server or internal services.

AN1424 Analytic 1424

Token retrieval from instance metadata endpoints such as AWS IMDS or Azure IMDS, followed by API usage using the obtained token from non-standard applications.

AN1425 Analytic 1425

Unusual OAuth app registration followed by user-granted OAuth tokens and subsequent high-privilege resource access via those tokens.

AN1426 Analytic 1426

Use of OAuth tokens by third-party apps to access user mail, calendar, or SharePoint resources where the token was granted recently or via spearphishing.

AN1427 Analytic 1427

Programmatic access to user content via stolen access tokens in platforms like Slack, GitHub, Google Workspace — especially from new IPs, apps, or excessive resource access.