T1671_cloud-application-integration

T1671 Cloud Application Integration

High-Level Description

Adversaries may achieve persistence by leveraging OAuth application integrations in a software-as-a-service environment. Adversaries may create a custom application, add a legitimate application into the environment, or even co-opt an existing integration to achieve malicious ends.

OAuth is an open standard that allows users to authorize applications to access their information on their behalf. In a SaaS environment such as Microsoft 365 or Google Workspace, users may integrate applications to improve their workflow and achieve tasks.

Leveraging application integrations may allow adversaries to persist in an environment – for example, by granting consent to an application from a high-privileged adversary-controlled account in order to maintain access to its data, even in the event of losing access to the account. In some cases, integrations may remain valid even after the original consenting user account is disabled. Application integrations may also allow adversaries to bypass multi-factor authentication requirements through the use of Application Access Tokens. Finally, they may enable persistent Automated Exfiltration over time.

Creating or adding a new application may require the adversary to create a dedicated Cloud Account for the application and assign it Additional Cloud Roles – for example, in Microsoft 365 environments, an application can only access resources via an associated service principal.

Kill Chain Phase

• Persistence (TA0003)

Platforms: Office Suite, SaaS

What to Check

• Identify if Cloud Application Integration technique is applicable to target environment
• Check Office Suite systems for indicators of Cloud Application Integration
• Check SaaS systems for indicators of Cloud Application Integration
• Verify mitigations are bypassed or absent (2 known mitigations)
• Assess detection coverage (1 detection strategies)

How to Test

Manual Testing

1. Identify Attack Surface: Determine if the target environment is susceptible to Cloud Application Integration by examining the target platforms (Office Suite, SaaS).

2. Assess Existing Defenses: Review whether mitigations for T1671 are in place. If defenses are absent or misconfigured, this technique may be exploitable.

3. Execute Test: Use tools and methods described in the MITRE ATT&CK page and external references below.

Note: No Atomic Red Team tests available for this technique. See Atomic Red Team GitHub for updates.

Remediation Guide

M1042 Disable or Remove Feature or Program

Do not allow users to add new application integrations into a SaaS environment. In Entra ID environments, consider enforcing the “Do not allow user consent” option.

M1047 Audit

Periodically review SaaS integrations for unapproved or potentially malicious applications.

Detection

Detection Strategy for Cloud Application Integration

Risk Assessment

CWE Categories

References

• Wiz Midnight Blizzard 2024
• Push Security SaaS Persistence 2022
• Push Security Slack Persistence 2023
• Microsoft Malicious OAuth Applications 2022
• Microsoft Entra ID Service Principals
• SaaS Attacks GitHub Evil Twin Integrations
• Huntress Persistence Microsoft 365 Compromise 2024
• Synes Cyber Corner Malicious Azure Application 2023
• Atomic Red Team - T1671
• MITRE ATT&CK - T1671