Techniques › T1697
T1697 Steal Application Specific Passwords
credential access — Office Suite, Identity Provider, SaaS · attack.mitre.org · JSON
1
MITRE detection strategy
3
analytics
0
Sigma rules tagged attack.t1697
0
KEV CVEs mapped here
<p>Adversaries may steal Application Specific Passwords (ASPs) to gain access to Valid Accounts, bypassing multifactor authentication (MFA) methods. ASPs are passwords typically used to give third-party applications or legacy devices (which do not support MFA methods) account access.</p><p>An adversary may socially engineer a user into providing an ASP (using methods like Phishing for Information), generate an ASP for an already compromised account, or obtain an ASP stored on a system. Afterward, adversaries may use the ASP to access Valid Accounts and, in some cases, maintain Persistence, bypassing any form of MFA set on the account.</p>
KEV CVEs mapped to this technique · CTID Mappings Explorer
None. No KEV entry in the public mapping names this technique. Given that 75.7% of KEV has no mapping at all, this says more about the mapping than about the technique.
Detection strategy · ATT&CK Enterprise v20.0
- DET0926 Suspicious Acquisition and Use of Application-Specific Passwords v1.0
AN2077 SaaSDetect successful SaaS authentication through an application-specific or legacy credential mechanism from a source/client not previously associated with that account, correlated with new session establishment or subsequent access inconsistent with ApprovedASPUsage.saas:audit
Successful application-specific/legacy credential authentication where exposed→ DC0002 User Account Authenticationsaas:sessionNew authenticated session associated with changed source/client context→ DC0067 Logon Session CreationTunable:ApprovedASPUsageAN2076 Office SuiteDetect successful Office Suite access using an authentication method that does not perform the account's expected MFA flow, correlated within ASPActivityWindow with first-seen client/application access, an anomalous source/device, or an ASP-related account credential change where available.m365:unifiedAuthentication/account audit event identifying app-password or applicable legacy-authentication activity→ DC0038 Application Log Contentazure:signinlogsSuccessful account authentication with authentication/client properties inconsistent with normal MFA-backed access→ DC0002 User Account AuthenticationAN2075 Identity ProviderDetect creation of an application-specific password for a user account, correlated within ASPActivityWindow with authentication from a source, device, client, or location outside the account's established baseline, or followed by authentication using a legacy/non-MFA authentication path inconsistent with ApprovedASPUsage.idp:auditApplication-specific password created/added for account→ DC0010 User Account Modificationidp:authenticationSuccessful authentication associated with legacy/application-specific credential flow→ DC0002 User Account Authenticationidp:sessionNew session established from source/device inconsistent with account baseline→ DC0067 Logon Session CreationTunable:ASPActivityWindowApprovedASPUsersApprovedASPApplicationsApprovedASPUsageKnownDevicesKnownLocationsExpectedAuthMethodsApprovedLegacyClientsKnownSourceRanges
Sigma rules · SigmaHQ c04ad420b4, tag attack.t1697
No Sigma rule carries this tag. MITRE publishes a detection strategy above, so the behaviour is specified; what is missing is public detection content.