Home

Awesome

<div align="center">

badge badge badge badge badge

<a href="https://pushsecurity.com"> <picture> <source media="(prefers-color-scheme: dark)" srcset="https://github.com/pushsecurity/saas-attacks/assets/95348608/7b32b771-5774-4b58-bd2b-1b8cd82c8857"> <img src="https://github.com/pushsecurity/saas-attacks/assets/95348608/f732944a-9066-4e5d-a0a3-8e1b77ee0526"> </picture> </a> </div>

[!NOTE] We're hiring! If you're into the kind of research we're doing here and based in the US, we'd love to hear from you!

SaaS attack techniques

This repository is a collection of SaaS-specific attack techniques. It is intended to be a resource for security researchers, red/blue teams, and penetration testers to learn about and share SaaS attack techniques.

Quick note: we wanted to start sharing as early as possible, so this is very much a work in progress. Hopefully there is enough to see the shape of things to come, but no doubt there are gaps - we'll be filling them in over the coming weeks and months. If you can help fill in some references, add examples, or point us to missing techniques - please open an issue (or even a PR)! We'll be very sure to credit you.

For more information on the background to this project, check the following blog post

The Microsoft BlueHat 2023 "The new SaaS cyber kill chain" presentation that covers a lot of this research can be found below:

BlueHat - The new SaaS cyber kill chain

For a podcast covering this topic, checkout the DCP Podcast by SpectreOps below:

DCP Podcast - Episode 35

The SaaS attacks matrix

We’ve taken inspiration from the MITRE ATT&CK framework (certainly intended as the sincerest form of flattery), but wanted to make a conscious break away from the endpoint-focused ATT&CK techniques and instead focus on techniques that are SaaS-first. In fact, none of these techniques touch endpoints or customer networks - so we’re calling them networkless attacks.

ReconnaissanceInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementExfiltration
SAML enumerationConsent phishingShadow workflowsAPI keysLink backdooringAPI keysPassword scrapingEmail discoveryLink backdooringTakeout services
Subdomain tenant discoveryPoisoned tenantsOAuth tokensOAuth tokensAbuse existing OAuth integrationsOAuth tokensAPI secret theftApp directory lookupAbuse existing OAuth integrationsWebhooks
Slug tenant enumerationSAMLjackingClient-side app spoofingEvil twin integrationsMalicious mail rulesEvil twin integrationsOAuth token enumerationAPI secret theftShadow workflows
DNS reconnaissanceAccount ambushingMalicious mail rulesMalicious mail rulesPasswordless logins
Username enumerationCredential stuffingLink sharingLink sharingAccount recovery
App sprayingSystem integrationsSystem integrationsIn-app phishing
Email phishingGhost loginsGhost loginsIM user spoofing
IM phishingClient-side app spoofingClient-side app spoofingAutomation workflow sharing
IM user spoofingInbound federationDevice code phishingSAMLjacking
nOAuthDevice enrollmentSession cookie theftInbound federation
MFA fatigueCross-idp impersonationSession cookie theft
Device code phishing
Hijack OAuth flows
AiTM Phishing
Device enrollment
Ghost logins
MFA downgrade
Guest access abuse
Cross-idp impersonation

Another divergence from the ATT&CK framework is that these techniques are not solely based on observation. Instead, we’re allowing more exploratory techniques that haven't been seen in the wild. We think this is important because SaaS is a relatively new attack surface, and we want to encourage security researchers to think creatively about how SaaS can be abused to better anticipate future attacks.

We’ve also removed a few columns that are common in these MITRE-style frameworks, some (like Impact) are so similar they aren't worth duplicating. Others (perhaps most notably the Command & Control phase) because they no longer apply. Since SaaS is delivered directly on the internet, you can’t force an attacker to access it through your web gateway. You can try forcing your own employees through a gateway, but attackers can access it directly like everyone else (there are edge cases here, but they are rare). This means there is generally no need for C2 techniques.

Finally, some need a slightly broader definition. For example, the Execution phase includes techniques that are not strictly code execution on an endpoint, but achieve an equivalent outcome in the SaaS context.

Scope

When we started this research project, the first task was to choose an initial scope. Like every good red-teamer, we wanted to start with low-cost techniques, so that means we were looking for techniques that:

While we left out techniques that are endpoint-based attacks that lead to a SaaS compromise (MITRE does a good job of these techniques) we think that it makes sense to add techniques to go from SaaS to the endpoint might make sense to add here. We're still thinking about this, but we'd love to hear your thoughts.