Adversaries may steal Application Specific Passwords (ASPs) to gain access to Valid Accounts, bypassing multifactor authentication (MFA) methods. ASPs are passwords typically used to give third-party applications or legacy devices (which do not support MFA methods) account access.[1][2]
An adversary may socially engineer a user into providing an ASP[3][4] (using methods like Phishing for Information), generate an ASP for an already compromised account,[5][6] or obtain an ASP stored on a system. Afterward, adversaries may use the ASP to access Valid Accounts and, in some cases, maintain Persistence, bypassing any form of MFA set on the account.
| ID | Name | Description |
|---|---|---|
| G1044 | APT42 |
APT42 has stolen application specific passwords in order to bypass MFA requirements to include victim environments who leverage the Microsoft App Password feature. [7] |
| ID | Mitigation | Description |
|---|---|---|
| M1036 | Account Use Policies |
Restrict authentication paths/clients/locations through which accounts using legacy/app-password authentication can authenticate. This matters because an ASP that has been stolen shouldn't automatically have unrestricted account reach. |
| M1042 | Disable or Remove Feature or Program |
Disable ASP functionality where modern authentication is available. Microsoft specifically supports disabling users' ability to create app passwords and recommends disabling legacy authentication so existing app passwords no longer work. |
| M1018 | User Account Management |
Restrict which users may create/use ASPs; disable ASP creation where unnecessary; remove existing ASPs. Microsoft allows admins to disable creation and separately delete existing ASPs; Google administrators can view/revoke users' application-specific passwords. |
| M1017 | User Training |
ASPs can be obtained through social engineering, which your technique explicitly includes. Train users not to generate or disclose ASPs in response to unsolicited instructions. |
| ID | Name | Analytic ID | Analytic Description |
|---|---|---|---|
| DET0926 | Suspicious Acquisition and Use of Application-Specific Passwords | AN2077 |
Detect successful SaaS authentication through an application-specific or legacy credential mechanism from a source/client not previously associated with that account, correlated with new session establishment or subsequent access inconsistent with ApprovedASPUsage. |
| AN2076 |
Detect successful Office Suite access using an authentication method that does not perform the account's expected MFA flow, correlated within ASPActivityWindow with first-seen client/application access, an anomalous source/device, or an ASP-related account credential change where available. |
||
| AN2075 |
Detect creation of an application-specific password for a user account, correlated within ASPActivityWindow with authentication from a source, device, client, or location outside the account's established baseline, or followed by authentication using a legacy/non-MFA authentication path inconsistent with ApprovedASPUsage. |