Steal Application Specific Passwords (T1697)

Tactic: Credential Access · Platforms: Office Suite, Identity Provider, SaaS

The interactive view maps 1 detection strategy, 4 mitigations, 1 threat group to this technique, alongside D3FEND countermeasures and data-component coverage.

Overview

Adversaries may steal Application Specific Passwords (ASPs) to gain access to Valid Accounts, bypassing multifactor authentication (MFA) methods. ASPs are passwords typically used to give third-party applications or legacy devices (which do not support MFA methods) account access. An adversary may socially engineer a user into providing an ASP (using methods like Phishing for Information), generate an ASP for an already compromised account, or obtain an ASP stored on a system. Afterward, adversaries may use the ASP to access Valid Accounts and, in some cases, maintain Persistence, bypassing any form of MFA set on the account.

Explore

• Open T1697 in the interactive ATT&CK matrix
• ATT&CK Intelligence View guide
• Official MITRE ATT&CK entry for T1697
• Sigma detection rules for MITRE ATT&CK
• Built by Shahrukh Khan