T1697 Steal Application Specific Passwords

Adversaries may steal Application Specific Passwords (ASPs) to gain access to Valid Accounts, bypassing multifactor authentication (MFA) methods. ASPs are passwords typically used to give third-party applications or legacy devices (which do not support MFA methods) account access. An adversary may socially engineer a user into providing an ASP (using methods like Phishing for Information), generate an ASP for an already compromised account, or obtain an ASP stored on a system. Afterward, adversaries may use the ASP to access Valid Accounts and, in some cases, maintain Persistence, bypassing any form of MFA set on the account.