CmdID

CmdID / Techniques

T1528 Steal Application Access Token

Adversaries can steal application access tokens as a means of acquiring credentials to access remote systems and resources. MITRE ATT&CK

1 program on CmdID 3 Sigma rules T1528 on attack.mitre.org

Programs for it

documented by LOLBAS and GTFOBins, or named by its rules
teams.exeits Sigma rules

Sigma rules tagged with it

process creation, the highest levels first
highRenamed BrowserCore.EXE ExecutionMax Altgelt (Nextron Systems) · Windows
mediumPotentially Suspicious Command Targeting Teams Sensitive Files@SerkinValery · Windows
mediumPotentially Suspicious JWT Token Search Via CLINasreddine Bencherchali (Nextron Systems), kagebunsher · Windows