/saas-attacks

Offensive security drives defensive security. We're sharing a collection of SaaS attack techniques to help defenders understand the threats they face. #nolockdown

Creative Commons Attribution 4.0 InternationalCC-BY-4.0

SaaS attack techniques

This repository is a collection of SaaS-specific attack techniques. It is intended to be a resource for security researchers, red/blue teams, and penetration testers to learn about and share SaaS attack techniques.

Quick note: we wanted to start sharing as early as possible, so this is very much a work in progress. Hopefully there is enough to see the shape of things to come, but no doubt there are gaps - we'll be filling them in over the coming weeks and months. If you can help fill in some references, add examples, or point us to missing techniques - please open an issue (or even a PR)! We'll be very sure to credit you.

For more information on the background to this project, check the following blog post

The SaaS attacks matrix

We’ve taken inspiration from the MITRE ATT&CK framework (certainly intended as the sincerest form of flattery), but wanted to make a conscious break away from the endpoint-focused ATT&CK techniques and instead focus on techniques that are SaaS-first. In fact, none of these techniques touch endpoints or customer networks - so we’re calling them networkless attacks.

Reconnaissance Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Exfiltration
SAML enumeration Consent phishing Shadow workflows API keys Link backdooring API keys Password scraping Email discovery Link backdooring Takeout services
Subdomain tenant discovery Poisoned tenants OAuth tokens OAuth tokens Abuse existing OAuth integrations OAuth tokens API secret theft App directory lookup Abuse existing OAuth integrations Webhooks
Slug tenant enumeration SAMLjacking Client-side app spoofing Evil twin integrations Malicious mail rules Evil twin integrations OAuth token enumeration API secret theft Shadow workflows
DNS reconnaissance Account ambushing Malicious mail rules Malicious mail rules Passwordless logins
Username enumeration Credential stuffing Link sharing Link sharing Account recovery
App spraying System integrations System integrations In-app phishing
Email phishing Ghost logins Ghost logins IM user spoofing
IM phishing Client-side app spoofing Client-side app spoofing Automation workflow sharing
IM user spoofing Device code phishing
nOAuth
MFA fatigue
Device code phishing

Another divergence from the ATT&CK framework is that these techniques are not solely based on observation. Instead, we’re allowing more exploratory techniques that haven't been seen in the wild. We think this is important because SaaS is a relatively new attack surface, and we want to encourage security researchers to think creatively about how SaaS can be abused to better anticipate future attacks.

We’ve also removed a few columns that are common in these MITRE-style frameworks, some (like Impact) are so similar they aren't worth duplicating. Others (perhaps most notably the Command & Control phase) because they no longer apply. Since SaaS is delivered directly on the internet, you can’t force an attacker to access it through your web gateway. You can try forcing your own employees through a gateway, but attackers can access it directly like everyone else (there are edge cases here, but they are rare). This means there is generally no need for C2 techniques.

Finally, some need a slightly broader definition. For example, the Execution phase includes techniques that are not strictly code execution on an endpoint, but achieve an equivalent outcome in the SaaS context.

Scope

When we started this research project, the first task was to choose an initial scope. Like every good red-teamer, we wanted to start with low-cost techniques, so that means we were looking for techniques that:

  • Avoid highly effective controls that are expensive to bypass, especially endpoint controls like EDR - so endpoint malware-based techniques are out
  • Look for features that can be abused long-term, rather than bugs that will be patched quickly - so no zero-days
  • Go beyond the dozen or so core SaaS apps like O365 and Google Workspace - look to the hundreds of other apps that have primitive security controls and store or have access to highly sensitive data

While we left out techniques that are endpoint-based attacks that lead to a SaaS compromise (MITRE does a good job of these techniques) we think that it makes sense to add techniques to go from SaaS to the endpoint might make sense to add here. We're still thinking about this, but we'd love to hear your thoughts.