Tools:
Summary:
The attached tool created and maintained by Push Security is a detailed mapping of various tactics and techniques used by adversaries during cyber attacks, aligned with the MITRE ATT&CK framework. The table is organized by different tactics (e.g., Reconnaissance, Initial Access, Execution, Persistence, etc.) and lists specific techniques used under each tactic. Here’s a summary:
- Reconnaissance:
- Techniques include SAML enumeration, subdomain tenant discovery, slug tenant enumeration, DNS reconnaissance, and username enumeration. These methods help attackers gather information about the target's systems and environment.
- Initial Access:
- Methods listed include consent phishing, poisoned tenants, SAMLjacking, account ambushing, credential stuffing, app spraying, email phishing, IM phishing, IM user spoofing, nOAuth, MFA fatigue, device code phishing, hijack OAuth flows, AiTM phishing, and device enrollment. These techniques are used to gain initial entry into the target system.
- Execution:
- Techniques such as shadow workflows, OAuth tokens, client-side app spoofing, device code phishing, and device enrollment are used to execute malicious code or activities once initial access has been gained.
- Persistence:
- Methods like API keys, OAuth tokens, evil twin integrations, malicious mail rules, link sharing, system integrations, ghost logins, client-side app spoofing, inbound federation, and device enrollment help attackers maintain their presence within the target system.
- Privilege Escalation:
- Techniques such as link backdooring and abuse of existing OAuth integrations are used to gain higher privileges within the system.
- Defense Evasion:
- Techniques listed include API keys, OAuth tokens, evil twin integrations, malicious mail rules, link sharing, system integrations, ghost logins, client-side app spoofing, and session cookie theft. These methods help attackers avoid detection and continue their activities.
- Credential Access:
- Methods like password scraping and API secret theft are used to obtain credentials, allowing further access and control over the system.
- Discovery:
- Techniques such as email discovery, app directory lookup, and OAuth token enumeration help attackers identify valuable information and additional targets within the system.
- Lateral Movement:
- Techniques include link backdooring, abuse of existing OAuth integrations, API secret theft, passwordless logins, account recovery, in-app phishing, automation workflow sharing, SAMLjacking, inbound federation, and session cookie theft. These methods allow attackers to move laterally across the network, expanding their control.
- Exfiltration:
- Methods listed include takeout services, webhooks, shadow workflows, IM user spoofing, and session cookie theft. These techniques are used to extract valuable data from the target system.
This tool provides a comprehensive overview of the various techniques used by attackers at different stages of an attack, helping cybersecurity professionals understand and mitigate these threats effectively.
Attack Specifics:
- Reconnaissance
- SAML enumeration: Attackers enumerate Security Assertion Markup Language (SAML) to identify valid user accounts.
- Subdomain tenant discovery: Attackers discover subdomains associated with different tenants within a SaaS application to identify targets.
- Slug tenant enumeration: Attackers enumerate tenant-specific slugs in URLs to discover valid tenants.
- DNS reconnaissance: Attackers use DNS queries to gather information about the target’s network and services.
- Username enumeration: Attackers identify valid usernames through direct queries or error messages.
- Initial Access
- Consent phishing: Attackers trick users into granting OAuth permissions to malicious applications.
- Poisoned tenants: Attackers compromise tenant configurations to introduce malicious elements.
- SAMLjacking: Attackers hijack SAML assertions to gain unauthorized access.
- Account ambushing: Attackers create accounts that mimic legitimate ones to gain trust and access.
- Credential stuffing: Attackers use previously stolen credentials to gain unauthorized access.
- App spraying: Attackers attempt to gain access by spraying common passwords across multiple accounts.
- Email phishing: Attackers use phishing emails to trick users into divulging credentials or installing malware.
- IM phishing: Attackers use instant messaging platforms to conduct phishing attacks.
- IM user spoofing: Attackers impersonate legitimate users on instant messaging platforms.
- nOAuth: Attackers exploit misconfigured OAuth implementations to gain access.
- MFA fatigue: Attackers overwhelm users with multi-factor authentication requests to trick them into approving access.
- Device code phishing: Attackers trick users into entering device codes on malicious websites.
- Execution
- Shadow workflows: Attackers create hidden workflows to execute malicious actions.
- OAuth tokens: Attackers steal or misuse OAuth tokens to gain unauthorized access.
- Client-side app spoofing: Attackers create malicious applications that mimic legitimate ones.
- Device enrollment: Attackers enroll malicious devices to gain access.
- Persistence
- API keys: Attackers steal or misuse API keys to access services.
- OAuth tokens: Attackers steal or misuse OAuth tokens to gain unauthorized access.
- Evil twin integrations: Attackers create malicious integrations that mimic legitimate ones.
- Malicious mail rules: Attackers create mail rules to forward or delete specific emails.
- Link sharing: Attackers share malicious links to compromise systems.
- System integrations: Attackers exploit integrations between systems to move laterally.
- Ghost logins: Attackers maintain persistent access through unnoticed logins.
- Client-side app spoofing: Attackers create malicious applications that mimic legitimate ones.
- Inbound federation: Attackers exploit federated identity systems to gain access.
- Device enrollment: Attackers enroll malicious devices to gain access.
- Privilege Escalation
- Link backdooring: Attackers create backdoors through malicious links.
- Abuse existing OAuth integrations: Attackers exploit legitimate OAuth integrations for unauthorized access.
- Evil twin integrations: Attackers create malicious integrations that mimic legitimate ones.
- Malicious mail rules: Attackers create mail rules to forward or delete specific emails.
- Link sharing: Attackers share malicious links to compromise systems.
- System integrations: Attackers exploit integrations between systems to move laterally.
- Defense Evasion
- API keys: Attackers steal or misuse API keys to access services.
- OAuth tokens: Attackers steal or misuse OAuth tokens to gain unauthorized access.
- Evil twin integrations: Attackers create malicious integrations that mimic legitimate ones.
- Malicious mail rules: Attackers create mail rules to forward or delete specific emails.
- Link sharing: Attackers share malicious links to compromise systems.
- System integrations: Attackers exploit integrations between systems to move laterally.
- Ghost logins: Attackers maintain persistent access through unnoticed logins.
- Client-side app spoofing: Attackers create malicious applications that mimic legitimate ones.
- Device code phishing: Attackers trick users into entering device codes on malicious websites.
- Session cookie theft: Attackers steal session cookies to hijack user sessions.
- Credential Access
- Password scraping: Attackers extract passwords from various sources.
- API secret theft: Attackers steal secrets used in API communications.
- Discovery
- Email discovery: Attackers discover email addresses to use in further attacks.
- App directory lookup: Attackers explore application directories for information and vulnerabilities.
- OAuth token enumeration: Attackers enumerate OAuth tokens to find valid ones.
- Lateral Movement
- Link backdooring: Attackers create backdoors through malicious links.
- Abuse existing OAuth integrations: Attackers exploit legitimate OAuth integrations for unauthorized access.
- API secret theft: Attackers steal secrets used in API communications.
- Passwordless logins: Attackers exploit passwordless login mechanisms to gain access.
- Account recovery: Attackers exploit account recovery processes to gain unauthorized access.
- In-app phishing: Attackers conduct phishing attacks within applications.
- IM user spoofing: Attackers impersonate users on instant messaging platforms to conduct attacks.
- Automation workflow sharing: Attackers share malicious workflows to automate attacks.
- SAMLjacking: Attackers hijack SAML assertions to gain unauthorized access.
- Inbound federation: Attackers exploit federated identity systems for access.
- Session cookie theft: Attackers steal cookies to hijack sessions.
- Exfiltration
- Takeout services: Attackers use export functions to exfiltrate data.
- Webhooks: Attackers misuse webhooks to extract data or execute actions.
- Shadow workflows: Attackers create hidden workflows for ongoing malicious activity.
