Clankerusecase
MITRE ATT&CK detection coverage
 ← Back to main site
Home/ MITRE Matrix/ Lateral Movement/ T1550.001

T1550.001Application Access Token

T1550.001 — Application Access Token is a MITRE ATT&CK technique in the Lateral Movement tactic. Clankerusecase tracks 21 detection use cases covering it and 10 threat-intel articles citing it.

Lateral Movement
View on the matrix → Filter Detection Library MITRE official spec ↗
21Use cases
10Articles
0Sub-techniques
1Tactic
↑ Parent technique: T1550 · Use Alternate Authentication Material

Use cases covering this technique (21)

AWS brute-force ConsoleLogin then AssumeRole Internal delivery · alerting DDCW GitHub PAT used from impossible-travel locations Internal delivery · alerting DD Google Workspace OAuth key making account changes Internal install · alerting DD [WEEKLY] Dev/CI Toolchain Credential Read + Egress to Non-Canonical Registry Internal actions · alerting DSPDDCS [WEEKLY] Edge-service post-exploitation chain: internet-facing daemon → child shell or token redemption within 10 min of external request Internal actions · alerting DSPDD [WEEKLY] OAuth Device-Code Consent Phish to Cross-IP Cloud Token Replay Internal c2 · alerting DSPDD [WEEKLY] Vendor / Third-Party OAuth App or SP Sign-in From Unbaselined Egress Followed by Bulk SaaS Object Read Internal actions · alerting DSPDD [LLM] Stolen credentials reused from TeamPCP C2 IP in AWS CloudTrail Bespoke actions · alerting ΣPDDCW [LLM] Transfer-station client fingerprint: Go-http-client/2.0,gzip(gfe) user-agent in web egress Bespoke c2 · hunting SΣP [LLM] Victim account takeover: new-IP sign-in within 1h of redirect_uri mismatch (CVE-2026-54588) Bespoke actions · alerting DSP [LLM] Better-Auth SCIM global user deletion via /scim/v2/Users from unsanctioned caller Bespoke actions · hunting SΣP [LLM] Better-Auth SCIM profile/email rewrite fan-out across many /scim/v2/Users resources Bespoke actions · hunting SP [LLM] Gitea PR head-branch update via API v1 pulls/{index}/update (CVE-2026-58443 exploit vector) Bespoke exploit · hunting SΣP [LLM] Gitea Actions V4 artifact signed-URL forgery via oversized artifactID (CVE-2026-58426) Bespoke exploit · alerting SΣP [LLM] Gitea artifact HMAC signature reused across mismatched task/artifact tuples (CVE-2026-58426) Bespoke exploit · alerting SP [LLM] Gitea runner enumerating cross-task DownloadArtifact contexts (CVE-2026-58426 read path) Bespoke actions · hunting SP [LLM] Envoy Gateway ServiceAccount token reuse for anomalous K8s API actions Bespoke actions · hunting SΣPDD [LLM] TSDProxy x-tsdproxy-auth-token leaked to backend in upstream HTTP requests Bespoke exploit · hunting SPDD [LLM] TSDProxy management-port replay: loopback connection to 127.0.0.1:8080 by non-proxy process Bespoke exploit · alerting DSΣPCS [LLM] TSDProxy management API abuse: /api/v1 request with forged x-tsdproxy-id and auth token Bespoke actions · alerting SPDD [LLM] FileBrowser identity-cycling: 3+ user identities from one untrusted source in 5 min Bespoke exploit · alerting SP

Articles citing this technique (10)

crit Team PCP Stole 78,330 Secrets From 2,186 Organizations. CloudSEK Just Published the List. art-35
high Token Jacking: Cybercriminals Could Be Stealing Your AI Resources art-112
crit [GHSA / CRITICAL] CVE-2026-54588: Poweradmin has Host Header Injection in OIDC redirect_uri, SAML ACS/SLO URL, and Logout Redirect Construct art-186
crit [GHSA / CRITICAL] GHSA-rjg6-39jm-rgg4: @better-auth/scim: account takeover and stale access via SCIM provider-id collision art-211
crit [GHSA / CRITICAL] CVE-2026-58443: Gitea: Public-only repository tokens can update private PR head branches art-228
crit [GHSA / CRITICAL] CVE-2026-58426: Gitea Actions Artifacts V4 signed URL HMAC ambiguity allows cross-repository artifact read and cross-task art-229
crit [GHSA / CRITICAL] CVE-2026-53713: Envoy Gateway: Authentication Bypass via Improper Input Validation in EnvoyExtensionPolicy Lua Allows Secr art-252
crit [GHSA / CRITICAL] GHSA-g936-7jqj-mwv8: TSDProxy: Internal proxy auth token forwarded to backend services enables management API escalation art-293
crit [GHSA / CRITICAL] CVE-2026-54089: File Browser: Authentication Bypass via Proxy Auth Header Forgery art-299
crit Webworm: New burrowing techniques art-459