Steal Application Access Token (T1528) is OAuth abuse: an attacker registers a rogue app in Entra ID, then phishes a user into granting consent or completing a device-code sign-in. The resulting token survives password resets, skips MFA on every use, and grants API access to mail, files, and directory data without ever touching a password.
Practice detecting Steal Application Access Token on realistic SIEM alerts in SOCSimulator Operations.
“Steal Application Access Token is documented as technique T1528 in MITRE ATT&CK® v19.1 under the Credential Access tactic. Detection requires visibility into SIEM telemetry.”
The attack starts with an app registration, not malware. An adversary registers an OAuth application in Entra ID (or Google Workspace, Okta, GitHub) under a name that mimics a trusted vendor, 'Google Defender' and 'McAfee Email Protection' are the names APT28 used against Gmail and Yahoo users, then requests delegated permissions such as Mail.Read, Files.ReadWrite.All, or offline_access. The attacker emails or messages the target a consent link pointing at the real identity provider's own consent screen, so nothing in the URL bar looks wrong. If the user clicks Accept, Entra ID issues the app an OAuth access token and, when offline_access was requested, a refresh token that keeps working long after the session ends.
Device-code phishing skips the consent screen entirely. The attacker starts a device-code auth flow against Microsoft's own endpoint, gets a short code, then calls or messages the victim, often posing as IT support running a Teams meeting, and talks them through entering that code at microsoft.com/devicelogin. The victim authenticates normally with their own MFA, but the resulting token goes to the attacker's session, not the victim's. Storm-2372's campaign, tracked by Microsoft since August 2024, used exactly this technique, and in February 2025 shifted to the Microsoft Authentication Broker's own client ID so the resulting token functioned as a Primary Refresh Token, unlocking every Microsoft 365 service without a second prompt.
A third path targets machine identities directly: an attacker with sufficient privilege in an app registration or service principal adds a new client secret or certificate, a credential add, then authenticates as that app going forward using their own added credential, no user interaction required at all. In Azure Storage specifically, a compromised or over-permissioned SAS token achieves the same outcome against blob and queue data, since a SAS token is itself the access credential and no separate sign-in step exists to catch it.
OAuth token theft usually opens the intrusion rather than closing it. It typically follows a phishing email or a vishing call that gets the target to click a consent link or read out a device code, so it sits right after Initial Access and functions as this campaign's Credential Access step. APT29 has used stolen tokens specifically because a token authenticates without a password, and Solorigate-era intrusions show the same actor adding credentials to existing service principals to keep access after the original entry point closed.
What follows depends on the scope granted. Mail.Read or Mail.ReadWrite consent leads straight into email collection and business email compromise, an attacker reading a mailbox for wire-transfer threads or resetting other accounts through password-reset emails. Files.ReadWrite.All or Sites.ReadWrite.All consent opens SharePoint and OneDrive for exfiltration. Because the token, not a session cookie, is the credential, it keeps working after the user changes their password and often survives until an administrator explicitly revokes the app's grant or expires the refresh token, which is why OAuth app theft shows up in intrusions that persist for weeks with no further phishing.
The following detection strategies help SOC analysts identify Steal Application Access Token activity. These methods apply across SIEM environments and can be implemented as detection rules, correlation queries, or behavioral analytics in your security platform.
AuditLogs
| where OperationName in ("Consent to application", "Add delegated permission grant", "Add app role assignment to service principal")
| where Result == "success"
| extend AppDisplayName = tostring(TargetResources[0].displayName),
AppId = tostring(TargetResources[0].id),
GrantedBy = tostring(InitiatedBy.user.userPrincipalName)
| project TimeGenerated, OperationName, AppDisplayName, AppId, GrantedByFlags the exact Entra ID audit-log operations SigmaHQ's 'App Granted Microsoft Permissions' rule (tagged attack.t1528) keys on: Add delegated permission grant and Add app role assignment to service principal, plus Microsoft's own Consent to application event, so both user-consent and admin-consent paths are covered.
SigninLogs
| where AuthenticationProtocol == "deviceCode" or ResultType in ("50199", "0")
| summarize Attempts = count(), ResultCodes = make_set(ResultType) by UserPrincipalName, bin(TimeGenerated, 5m)
| where ResultCodes has "50199" and ResultCodes has "0"
| project TimeGenerated, UserPrincipalName, Attempts, ResultCodesMirrors the correlation Microsoft's Storm-2372 hunting guidance uses: error 50199 (interaction required) immediately followed by a successful sign-in for the same account within five minutes, the signature of a victim typing in an attacker-supplied device code rather than authenticating on their own initiative.
TimeGenerated: 2026-07-16 09:07:41
OperationName: Consent to application
Category: ApplicationManagement
InitiatedBy: jsmith@corp.local
TargetResource: SecureDocViewer (AppId: 4f2a91e3-7c88-4b1a-9e02-1a6d5c8f9b31)
ConsentScope: Mail.Read offline_access
Result: success
IPAddress: 198.51.100.24Most consent events in a tenant are legitimate. Employees connect real productivity add-ins, calendar sync tools, and CRM integrations that legitimately need Mail.Read or Calendars.ReadWrite, and IT regularly registers first-party automation apps that add their own client secrets during deployment. A rule that alerts on every Consent to application event will drown the SOC in Slack integrations and Zoom add-ins within a day.
Separate noise from signal on app age, publisher verification, and scope. An app registered years ago with a verified publisher requesting Calendars.Read is routine; an app registered eleven minutes before a consent grant, with no verified publisher, requesting Mail.Read plus offline_access, is not. For device-code flow, build a 30-day baseline per user: someone who authenticates via device code weekly for a CLI tool is normal, a user who has never used the flow suddenly hitting error 50199 followed by success is worth escalating. For credential adds, correlate against CI/CD deployment windows; a secret added by the pipeline's own service account during a scheduled release is not the same event as one added by a human account at 2 a.m.
These realistic alert examples show what Steal Application Access Token looks like in your security tools. Use them to tune detection rules and train analysts to recognize true positives versus false positives in live environments.
A newly registered app 'SecureDocViewer' requested and received user consent for Mail.Read and offline_access scopes from jsmith@corp.local eight minutes after a phishing email link. The app has no verified publisher and was registered eleven minutes before the consent grant.
User mgarcia@corp.local hit error 50199 (interaction required) at 09:14:02 and a successful sign-in landed three minutes later with AuthenticationProtocol=deviceCode, tied to the Microsoft Authentication Broker client, consistent with entering an attacker-supplied code.
Global Administrator agarcia@corp.local granted tenant-wide admin consent to app 'Zoom Meetings Sync', which carries no verified-publisher badge, three days after it was first registered, extending Mail.ReadWrite and Files.ReadWrite.All to every user in the tenant.
When a consent or device-code alert fires, the first question is whether the app or sign-in was expected: check with the user, check the app's publisher verification status in Entra ID, and check whether the scopes requested match anything the business actually uses. If the app is unverified, newly registered, or requesting scopes with no legitimate business tie, offline_access on a document viewer, for instance, treat it as compromised access, not a support ticket.
Containment means revoking the grant, not just warning the user. Remove the OAuth consent from Entra ID (or the equivalent in Google Workspace or Okta), disable or delete the malicious app registration and its service principal, and force a token refresh so any live access token or Primary Refresh Token stops working immediately, since revoking consent alone does not always kill a token already issued. Rotate any SAS tokens or client secrets the compromised identity could have touched, and pull the audit log for everything that app or credential did between grant and revocation, mailbox reads, file downloads, further consent grants, since a stolen token is frequently used to pivot into a second, more privileged app registration before anyone notices the first one.
Investigate Steal Application Access Token on realistic SIEM, XDR, and firewall consoles, free.
A routine Chrome auto-update silently trojanized a productivity extension on a finance workstation at Halverson Logistics. The extension beaconed to an attacker C2 domain, harvested the analyst's session cookies and an API token, and exfiltrated them to a VULTR-hosted server. With no malware on disk, the proxy and firewall logs are the only trail. Walk them step by step to trace the beacon, the theft, and the exfiltration.
Analyze a sophisticated attack targeting Azure Blob Storage and Entra ID. This scenario covers the transition from initial OAuth phishing to token replay and persistent cloud access. You will investigate impossible travel alerts, rogue application consent, and unauthorized storage enumeration using real-world cloud telemetry.
A brute force attack systematically tries large numbers of username and password combinations, or decryption keys, until…
Read more GlossaryMulti-Factor Authentication (MFA) requires a user to prove their identity with two or more independent factors, somethin…
Read more GlossaryLateral movement is the attack phase where adversaries expand access from an initial foothold to additional systems, usi…
Read more GlossarySecurity Information and Event Management (SIEM) is a platform that aggregates, normalizes, and correlates log data from…
Read more Career PathTier 1 SOC Analysts are the front line. You monitor alert queues, triage incoming detections, classify them as true or f…
Read more Career PathIncident Responders lead the technical response when confirmed breaches happen. You coordinate containment, run forensic…
Read more ToolThe SIEM console in SOCSimulator replicates the workflow of enterprise platforms like Splunk Enterprise Security, Micros…
Read more ComparisonSOCSimulator wins on operational realism. You get multi-tool shift simulation with SLA pressure, noise injection, and al…
Read more GlossaryComplete glossary of Security Operations Center terminology for aspiring SOC analysts.
Read more FeaturePractice alert triage under realistic time pressure with SLA timers and noise injection.
Read more FeatureStructured CTF-style investigation operations covering real-world attack scenarios.
Read more BlogArticles on SOC analyst skills, detection engineering, and career development.
Read more