Techniques › T1671
T1671 Cloud Application Integration
persistence — Office Suite, SaaS · attack.mitre.org · JSON
1
MITRE detection strategy
2
analytics
0
Sigma rules tagged attack.t1671
0
KEV CVEs mapped here
<p>Adversaries may achieve persistence by leveraging OAuth application integrations in a software-as-a-service environment. Adversaries may create a custom application, add a legitimate application into the environment, or even co-opt an existing integration to achieve malicious ends.</p><p>OAuth is an open standard that allows users to authorize applications to access their information on their behalf. In a SaaS environment such as Microsoft 365 or Google Workspace, users may integrate applications to improve their workflow and achieve tasks.</p><p>Leveraging application integrations may allow adversaries to persist in an environment – for example, by granting consent to an application from a high-privileged adversary-controlled account in order to maintain access to its data, even in the event of losing access to the account. In some cases, integrations may remain valid even after the original consenting user account is disabled. Application integrations may also allow adversaries to bypass multi-factor authentication requirements through the use of Application Access Tokens. Finally, they may enable persistent Automated Exfiltration over time.</p><p>Creating or adding a new application may require the adversary to create a dedicated Cloud Account for the application and assign it Additional Cloud Roles – for example, in Microsoft 365 environments, an application can only access resources via an associated service principal.</p>
KEV CVEs mapped to this technique · CTID Mappings Explorer
None. No KEV entry in the public mapping names this technique. Given that 74.7% of KEV has no mapping at all, this says more about the mapping than about the technique.
Detection strategy · ATT&CK Enterprise v19.2
- DET0539 Detection Strategy for Cloud Application Integration v1.0
AN1487 Office SuiteDetects suspicious OAuth application integrations within Office 365 or Google Workspace environments, such as new app registrations, unexpected consent grants, or privilege assignments. Defenders should correlate between application creation/modification events and associated user or service principal activity to identify persistence via app integrations.m365:unified
Add app role assignment grant to user: Consent to application by privileged or unexpected accounts→ DC0066 Active Directory Object Modificationazure:auditConsent to application: OAuth application consent granted to service principal→ DC0069 Cloud Service ModificationTunable:PrivilegedUserListApplicationScopeThresholdAN1488 SaaSDetects anomalous SaaS application integration activity across environments such as Slack, Salesforce, or other enterprise SaaS services. Focus is on unauthorized app additions, unusual permission grants, and persistence through service principal tokens.saas:integrationNew or modified third-party application integrations with elevated permissions→ DC0069 Cloud Service Modificationsaas:auditApplication added or consent granted: Integration persisting after original user disabled→ DC0038 Application Log ContentTunable:AppWhitelistConsentDelegationPolicy
Sigma rules · SigmaHQ da9bb07d64, tag attack.t1671
No Sigma rule carries this tag. MITRE publishes a detection strategy above, so the behaviour is specified; what is missing is public detection content.