T1550.001: Application Access Token

T1550.001: Application Access Token

Adversaries may use stolen application access tokens to bypass the typical authentication process and access restricted accounts, information, or services on remote systems. These tokens are typically stolen from users or services and used in lieu of login credentials.

View on MITRE ATT&CK →

AWS AssumeRole

Returns temporary security credentials for assuming an IAM role. Allows an entity (user, service, or account) to act with the role's permissions.

Cloud Service: AWS - STS

Tactics:

Initial Access Privilege Escalation Lateral Movement Stealth

Techniques:

T1078.004T1550.001

Tags:

AWS STS

AWS AssumeRoleWithSAML

Returns temporary credentials for a SAML-authenticated user to assume an IAM role, used in federated SSO scenarios.

Cloud Service: AWS - STS

Tactics:

Initial Access Privilege Escalation Lateral Movement Stealth

Techniques:

T1078.004T1550.001

Tags:

AWS STS

AWS AssumeRoleWithWebIdentity

Returns temporary credentials for a user authenticated via an OIDC identity provider (e.g., Cognito, Google) to assume an IAM role.

Cloud Service: AWS - STS

Tactics:

Initial Access Privilege Escalation Lateral Movement Stealth

Techniques:

T1078.004T1550.001

Tags:

AWS STS

AWS GetSigninToken

Generates a sign-in token used to construct a federation URL for single sign-on to the AWS Management Console.

Cloud Service: AWS - SignIn

Tactics:

Credential Access Lateral Movement

Techniques:

T1528T1550.001

Tags:

AWS SignIn