T1528 Steal Application Access Token — Attack Simulation

Adversaries can steal application access tokens as a means of acquiring credentials to access remote systems and resources. Application access tokens are used to make authorized API requests on behalf of a user or service and are commonly used as a way to access resources in cloud and container-based applications and software-as-a-service (SaaS). Adversaries who steal account API tokens in cloud and containerized environments may be able to…

Technique description

At least one platform-compatible Atomic procedure is documented. Individual review, lab prerequisites, and validation remain required.

Official ATT&CK definition · Detection rules and anomaly models

Documented simulation candidates

Azure - Functions code upload - Functions code injection via File Share modification to retrieve the Functions identity access token
iaas:azure automated powershell
Procedure 67aaf4cb-54ce-42e2-ab56-e0a9bcc089b1; elevation not declared required; cleanup present, not reviewed. Not executed or individually validated.
Azure - Functions code upload - Functions code injection via Blob upload
iaas:azure automated powershell
Procedure 9a5352e4-56e5-45c2-9b3f-41a46d3b3a43; elevation not declared required; cleanup present, not reviewed. Not executed or individually validated.

Connected ecosystem references

Linked tags

enterprise cloud containers identity onprem saas Containers IaaS Identity Provider Office Suite SaaS credential-access isolated_authorized_lab procedure_review_required telemetry_configuration_required disposable_tenant_and_cost_controls

can_simulate technique source_mapped

Detection and collection

T1528 detection workspace

Attack tools

Threat actor context

These are explicit actor-to-technique associations in the existing Threat Matrix snapshot, not attribution of an event or proof that a detector identifies the actor. No tool-to-actor relationship is inferred.

Existing research

Threat Matrix: knowledge routes, evidence and actor context

Pinned research references. No browser attack runner, live simulation result or validated detector is asserted. Source mappings and validation limits are preserved. ATT&CK / Atomic provenance · Detection provenance.