Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →cyberstrikeus/T1671_cloud-application-integration
Adversaries may achieve persistence by leveraging OAuth application integrations in a software-as-a-service environment.
Passed 23 of 24 test cases with the skill, and 14 of 24 without it.
and 10 more in the full report
9 fixed14 passed either way1 still failing0 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 9 test cases the skill fixed. Same model, same prompt, with and without the skill.
When categorizing threat activity involving rogue OAuth integrations in Microsoft 365 and Google Workspace within the MITRE ATT&CK Enterprise matrix, which specific platforms are defined for this technique?
| Checked | Without skill | With skill |
|---|---|---|
| Specifies Office Suite as a target platform. | Missed | Passed |
| Specifies SaaS as a target platform. | Passed | Passed |
The instructions your model reads when the skill loads.
Adversaries may achieve persistence by leveraging OAuth application integrations in a software-as-a-service environment. Adversaries may create a custom application, add a legitimate application into the environment, or even co-opt an existing integration to achieve malicious ends.
OAuth is an open standard that allows users to authorize applications to access their information on their behalf. In a SaaS environment such as Microsoft 365 or Google Workspace, users may integrate applications to improve their workflow and achieve tasks.
Leveraging application integrations may allow adversaries to persist in an environment – for example, by granting consent to an application from a high-privileged adversary-controlled account in order to maintain access to its data, even in the event of losing access to the account. In some cases, integrations may remain valid even after the original consenting user account is disabled. Application integrations may also allow adversaries to bypass multi-factor authentication requirements through the use of Application Access Tokens. Finally, they may enable persistent Automated Exfiltration over time.
Creating or adding a new application may require the adversary to create a dedicated Cloud Account for the application and assign it Additional Cloud Roles – for example, in Microsoft 365 environments, an application can only access resources via an associated service principal.
Platforms: Office Suite, SaaS
Identify Attack Surface: Determine if the target environment is susceptible to Cloud Application Integration by examining the target platforms (Office Suite, SaaS).
Assess Existing Defenses: Review whether mitigations for T1671 are in place. If defenses are absent or misconfigured, this technique may be exploitable.
Execute Test: Use tools and methods described in the MITRE ATT&CK page and external references below.
Note: No Atomic Red Team tests available for this technique. See Atomic Red Team GitHub for updates.
test cases passed, vs 14 / 24 without
More skills from the same source and nearby in the registry, with their headline benchmark lift.