自动化接入 · API / MCP EN

技术说明 · T1697

Steal Application Specific Passwords

Adversaries may steal Application Specific Passwords (ASPs) to gain access to Valid Accounts, bypassing multifactor authentication (MFA) methods. ASPs are passwords typically used to give third-party applications or legacy devices (which do not support MFA methods) account access. An adversary may socially engineer a user into providing an ASP (using methods like Phishing for Information), generate an ASP for an already compromised account, or obtain an ASP stored on a system. Afterward, adversaries may use the ASP to access Valid Accounts and, in some cases, maintain Persistence, bypassing any form of MFA set on the account.

ATT&CK T1697 platforms — 状态 有效 版本 20.1

Adversaries may steal Application Specific Passwords (ASPs) to gain access to Valid Accounts, bypassing multifactor authentication (MFA) methods. ASPs are passwords typically used to give third-party applications or legacy devices (which do not support MFA methods) account access.12 An adversary may socially engineer a user into providing an ASP34 (using methods like Phishing for Information), generate an ASP for an already compromised account,56 or obtain an ASP stored on a system. Afterward, adversaries may use the ASP to access Valid Accounts and, in some cases, maintain Persistence, bypassing any form of MFA set on the account.

  1. Application Specific Passwords
  2. Application Specific Passwords Push Sec
  3. UNC6293 ASP Creative Phishing Attack
  4. Application Specific Passwords Phishing
  5. Mandiant APT42-untangling
  6. TAG APT42

使用该技术的组织

组织名称国家
grp_g1044APT42Iran

断言

尚无指向该技术的公开断言。

记录自动入库·未人工复核；置信度与有效期按引用读取。