Note

We're hiring! If you're into the kind of research we're doing here and based in the US, we'd love to hear from you!

SaaS attack techniques

This repository is a collection of SaaS-specific attack techniques. It is intended to be a resource for security researchers, red/blue teams, and penetration testers to learn about and share SaaS attack techniques.

Quick note: we wanted to start sharing as early as possible, so this is very much a work in progress. Hopefully there is enough to see the shape of things to come, but no doubt there are gaps - we'll be filling them in over the coming weeks and months. If you can help fill in some references, add examples, or point us to missing techniques - please open an issue (or even a PR)! We'll be very sure to credit you.

For more information on the background to this project, check the following blog post

The Microsoft BlueHat 2023 "The new SaaS cyber kill chain" presentation that covers a lot of this research can be found below:

BlueHat - The new SaaS cyber kill chain

For a podcast covering this topic, checkout the DCP Podcast by SpectreOps below:

DCP Podcast - Episode 35

The SaaS attacks matrix

We’ve taken inspiration from the MITRE ATT&CK framework (certainly intended as the sincerest form of flattery), but wanted to make a conscious break away from the endpoint-focused ATT&CK techniques and instead focus on techniques that are SaaS-first. In fact, none of these techniques touch endpoints or customer networks - so we’re calling them networkless attacks.

Reconnaissance	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Exfiltration
SAML enumeration	Consent phishing	Shadow workflows	API keys	Link backdooring	API keys	Password scraping	Email discovery	Link backdooring	Takeout services
Subdomain tenant discovery	Poisoned tenants	OAuth tokens	OAuth tokens	Abuse existing OAuth integrations	OAuth tokens	API secret theft	App directory lookup	Abuse existing OAuth integrations	Webhooks
Slug tenant enumeration	SAMLjacking	Client-side app spoofing	Evil twin integrations	Malicious mail rules	Evil twin integrations		OAuth token enumeration	API secret theft	Shadow workflows
DNS reconnaissance	Account ambushing		Malicious mail rules		Malicious mail rules			Passwordless logins
Username enumeration	Credential stuffing		Link sharing		Link sharing			Account recovery
	App spraying		System integrations		System integrations			In-app phishing
	Email phishing		Ghost logins		Ghost logins			IM user spoofing
	IM phishing		Client-side app spoofing		Client-side app spoofing			Automation workflow sharing
	IM user spoofing		Inbound federation		Device code phishing			SAMLjacking
	nOAuth		Device enrollment		Session cookie theft			Inbound federation
	MFA fatigue							Session cookie theft
	Device code phishing
	Hijack OAuth flows
	AiTM Phishing
	Device enrollment
	Ghost logins
	MFA downgrade
	Guest access abuse

Another divergence from the ATT&CK framework is that these techniques are not solely based on observation. Instead, we’re allowing more exploratory techniques that haven't been seen in the wild. We think this is important because SaaS is a relatively new attack surface, and we want to encourage security researchers to think creatively about how SaaS can be abused to better anticipate future attacks.

We’ve also removed a few columns that are common in these MITRE-style frameworks, some (like Impact) are so similar they aren't worth duplicating. Others (perhaps most notably the Command & Control phase) because they no longer apply. Since SaaS is delivered directly on the internet, you can’t force an attacker to access it through your web gateway. You can try forcing your own employees through a gateway, but attackers can access it directly like everyone else (there are edge cases here, but they are rare). This means there is generally no need for C2 techniques.

Finally, some need a slightly broader definition. For example, the Execution phase includes techniques that are not strictly code execution on an endpoint, but achieve an equivalent outcome in the SaaS context.

Scope

When we started this research project, the first task was to choose an initial scope. Like every good red-teamer, we wanted to start with low-cost techniques, so that means we were looking for techniques that:

• Avoid highly effective controls that are expensive to bypass, especially endpoint controls like EDR - so endpoint malware-based techniques are out
• Look for features that can be abused long-term, rather than bugs that will be patched quickly - so no zero-days
• Go beyond the dozen or so core SaaS apps like O365 and Google Workspace - look to the hundreds of other apps that have primitive security controls and store or have access to highly sensitive data

While we left out techniques that are endpoint-based attacks that lead to a SaaS compromise (MITRE does a good job of these techniques) we think that it makes sense to add techniques to go from SaaS to the endpoint might make sense to add here. We're still thinking about this, but we'd love to hear your thoughts.