Steal Application Access Token

Technique · ATTACK:enterprise:T1528

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:enterprise:T1528",
  "title": "Steal Application Access Token",
  "type": "Technique",
  "source_url": "https://attack.mitre.org/techniques/T1528",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--890c9858-598c-401d-a4d5-c67ebcdd703a",
  "external_id": "T1528",
  "domain": "enterprise",
  "created": "2019-09-04T15:54:25.684Z",
  "modified": "2026-05-12T15:12:00.694Z",
  "version": "1.5",
  "aliases": [

  ],
  "tactics": [
    "credential-access"
  ],
  "source_references": [
    {
      "source_name": "Amnesty OAuth Phishing Attacks, August 2019",
      "url": "https://www.amnesty.org/en/latest/research/2019/08/evolving-phishing-attacks-targeting-journalists-and-human-rights-defenders-from-the-middle-east-and-north-africa/"
    },
    {
      "source_name": "SpecterOps Managed Identity 2022",
      "url": "https://posts.specterops.io/managed-identity-attack-paths-part-1-automation-accounts-82667d17187a?gi=6a9daedade1c"
    },
    {
      "source_name": "Auth0 Understanding Refresh Tokens",
      "url": "https://auth0.com/learn/refresh-tokens"
    },
    {
      "source_name": "Auth0 - Why You Should Always Use Access Tokens to Secure APIs Sept 2019",
      "url": "https://auth0.com/blog/why-should-use-accesstokens-to-secure-an-api/"
    },
    {
      "source_name": "Cider Security Top 10 CICD Security Risks",
      "url": "https://web.archive.org/web/20220316130828/https://www.cidersecurity.io/top-10-cicd-security-risks/"
    },
    {
      "source_name": "Trend Micro Pawn Storm OAuth 2017",
      "url": "https://blog.trendmicro.com/trendlabs-security-intelligence/pawn-storm-abuses-open-authentication-advanced-social-engineering-attacks"
    },
    {
      "source_name": "Kubernetes Service Accounts",
      "url": "https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/"
    },
    {
      "source_name": "Entra Managed Identities 2025",
      "url": "https://learn.microsoft.com/en-us/entra/identity/managed-identities-azure-resources/how-to-use-vm-token"
    },
    {
      "source_name": "Microsoft - Azure AD Identity Tokens - Aug 2019",
      "url": "https://docs.microsoft.com/en-us/azure/active-directory/develop/access-tokens"
    },
    {
      "source_name": "Microsoft - Azure AD App Registration - May 2019",
      "url": "https://docs.microsoft.com/en-us/azure/active-directory/develop/quickstart-register-app"
    },
    {
      "source_name": "Microsoft - OAuth Code Authorization flow - June 2019",
      "url": "https://docs.microsoft.com/en-us/azure/active-directory/develop/v2-oauth2-auth-code-flow"
    },
    {
      "source_name": "Microsoft Identity Platform Protocols May 2019",
      "url": "https://docs.microsoft.com/en-us/azure/active-directory/develop/active-directory-v2-protocols"
    }
  ]
}

Explicit source assertions (18)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.