T1550.001: Application Access Token

T1550.001: Application Access Token

Adversaries may use stolen application access tokens to bypass the typical authentication process and access restricted accounts, information, or services on remote systems. These tokens are typically stolen from users or services and used in lieu of login credentials.

View on MITRE ATT&CK →

AWS AssumeRole

Returns temporary security credentials for assuming an IAM role. Allows an entity (user, service, or account) to act with the role's permissions.

Cloud Service: AWS - STS

Tactics:

Initial Access Privilege Escalation Lateral Movement Stealth

Techniques:

T1078.004T1550.001

Tags:

AWS STS

AWS AssumeRoleWithSAML

Exchanges a validated SAML assertion for temporary IAM role credentials.

Cloud Service: AWS - STS

Tactics:

Initial Access Privilege Escalation Lateral Movement Stealth

Techniques:

T1078.004T1550.001

Tags:

AWS STS

AWS AssumeRoleWithWebIdentity

Exchanges a web-identity token for temporary IAM role credentials.

Cloud Service: AWS - STS

Tactics:

Initial Access Privilege Escalation Lateral Movement Stealth

Techniques:

T1078.004T1550.001

Tags:

AWS STS