Steal Application Specific Passwords
- ID
- T1697
- Tactics
- TA0006 Credential Access
- Platforms
- Office Suite, Identity Provider, SaaS
- Data sources
- User Account Authentication, User Account Modification, Logon Session Creation, Application Log Content
- Source
- attack.mitre.org
- MITRE last modified
- 7 Oct 2026
Adversaries may steal Application Specific Passwords (ASPs) to gain access to Valid Accounts, bypassing multifactor authentication (MFA) methods. ASPs are passwords typically used to give third-party applications or legacy devices (which do not support MFA methods) account access.[1][2]
An adversary may socially engineer a user into providing an ASP[3][4] (using methods like Phishing for Information), generate an ASP for an already compromised account,[5][6] or obtain an ASP stored on a system. Afterward, adversaries may use the ASP to access Valid Accounts and, in some cases, maintain Persistence, bypassing any form of MFA set on the account.
Detection
- DET0926 Suspicious Acquisition and Use of Application-Specific Passwords
Data components: User Account Authentication, User Account Modification, Logon Session Creation, Application Log Content
Mitigations (4)
- M1017 User Training
ASPs can be obtained through social engineering, which your technique explicitly includes. Train users not to generate or disclose ASPs in response to unsolicited instructions.
- M1018 User Account Management
Restrict which users may create/use ASPs; disable ASP creation where unnecessary; remove existing ASPs. Microsoft allows admins to disable creation and separately delete existing ASPs; Google administrators can view/revoke users' application-specific passwords.
- M1036 Account Use Policies
Restrict authentication paths/clients/locations through which accounts using legacy/app-password authentication can authenticate. This matters because an ASP that has been stolen shouldn't automatically have unrestricted account reach.
- M1042 Disable or Remove Feature or Program
Disable ASP functionality where modern authentication is available. Microsoft specifically supports disabling users' ability to create app passwords and recommends disabling legacy authentication so existing app passwords no longer work.