Application Access Token

{
  "id": "ATTACK:enterprise:T1550.001",
  "title": "Application Access Token",
  "type": "Subtechnique",
  "source_url": "https://attack.mitre.org/techniques/T1550/001",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--f005e783-57d4-4837-88ad-dbe7faee1c51",
  "external_id": "T1550.001",
  "domain": "enterprise",
  "created": "2020-01-30T17:37:22.261Z",
  "modified": "2026-05-12T15:12:00.723Z",
  "version": "2.0",
  "aliases": [

  ],
  "tactics": [
    "lateral-movement"
  ],
  "source_references": [
    {
      "source_name": "Crowdstrike AWS User Federation Persistence",
      "url": "https://www.crowdstrike.com/blog/how-adversaries-persist-with-aws-user-federation/"
    },
    {
      "source_name": "Auth0 - Why You Should Always Use Access Tokens to Secure APIs Sept 2019",
      "url": "https://auth0.com/blog/why-should-use-accesstokens-to-secure-an-api/"
    },
    {
      "source_name": "AWS Temporary Security Credentials",
      "url": "https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_request.html"
    },
    {
      "source_name": "Microsoft Identity Platform Access 2019",
      "url": "https://docs.microsoft.com/en-us/azure/active-directory/develop/access-tokens"
    },
    {
      "source_name": "Google Cloud Service Account Credentials",
      "url": "https://cloud.google.com/iam/docs/creating-short-lived-service-account-credentials"
    },
    {
      "source_name": "okta",
      "url": "https://developer.okta.com/blog/2018/06/20/what-happens-if-your-jwt-is-stolen"
    },
    {
      "source_name": "Rhino Security Labs Enumerating AWS Roles",
      "url": "https://rhinosecuritylabs.com/aws/assume-worst-aws-assume-role-enumeration"
    },
    {
      "source_name": "Staaldraad Phishing with OAuth 2017",
      "url": "https://staaldraad.github.io/2017/08/02/o356-phishing-with-oauth/"
    }
  ]
}