Application Access Token
Sub-technique of AML.T0091 Use Alternate Authentication Material
Description
Adversaries may use stolen application access tokens to bypass the typical authentication process and access restricted accounts, information, or services on remote systems. These tokens are typically stolen from users or services and used in lieu of login credentials.
Application access tokens are used to make authorized API requests on behalf of a user or service and are commonly used to access resources in cloud, container-based applications, software-as-a-service (SaaS), and AI-as-a-service(AIaaS). They are commonly used for AI services such as chatbots, LLMs, and predictive inference APIs.
- ATLAS ID
- AML.T0091.000
- Maturity
- RealizedUsed by real adversaries against AI systems in the wild.
- Platforms
- Enterprise
Mitigations
- AML.M0019Control Access to AI Models and Data in Production
Enforce authorization and monitor production AI API use for anomalous activity associated with replayed access tokens.
Case studies that use it
Related ATT&CK technique
ATLAS adapts this technique from MITRE ATT&CK Enterprise.
Across MITRE's defensive frameworks
Linked through the 1 ATT&CK technique above.
Counter with D3FEND
Defensive techniques MITRE D3FEND maps to the same ATT&CK techniques.
- D3-TBAToken-based Authentication1 shared
- D3-TBToken Binding1 shared
- D3-WSAMWeb Session Access Mediation1 shared
- D3-ABPIApplication-based Process Isolation1 shared
- D3-HRHost Reboot1 shared
- D3-HSHost Shutdown1 shared
- D3-KBPIKernel-based Process Isolation1 shared
- D3-PLAProcess Lineage Analysis1 shared
- D3-PSMDProcess Self-Modification Detection1 shared
- D3-PSProcess Suspension1 shared
- D3-PTProcess Termination1 shared
- D3-ANCIAuthentication Cache Invalidation1 shared
Detect with CAR
MITRE CAR analytics that cover the same ATT&CK techniques.