h4cker/cloud_resources/omar_saas_attack_example.svg

<?xml version="1.0" standalone="no"?>
<svg width="1056" height="816" xmlns="http://www.w3.org/2000/svg" id="svgvm0"><g transform="translate(5,5)" style="font-family: sans-serif;"><g><g transform="translate(0, 0)"><g transform="translate(0,5)"><rect class="header-box" width="509.5897435897436" height="86" stroke="black" fill="white" rx="5"/><rect class="label-cover" x="8" y="-10" width="34.03125" height="18" fill="white" rx="5"/><text class="header-box-label" x="10" font-size="12" fill="black" y="3">about</text><g class="header-box-content" fill="black" transform="translate(5, 0)"><g transform="translate(0, 2.0975609756097526)"><text font-size="12"><tspan x="4" y="23.426829268292682">Omar's SaaS</tspan></text><line x1="0" x2="499.5897435897436" y1="39.853658536585364" y2="39.853658536585364" stroke="#dddddd"/></g><g transform="translate(0, 44.048780487804876)"><text font-size="12"><tspan x="4" y="23.426829268292682">MITRE ATT&amp;CK TTPs for SaaS implementations</tspan></text></g></g></g></g><g transform="translate(536.4102564102565, 0)"><g transform="translate(0,5)"><rect class="header-box" width="509.5897435897436" height="86" stroke="black" fill="white" rx="5"/><rect class="label-cover" x="8" y="-10" width="53.3515625" height="18" fill="white" rx="5"/><text class="header-box-label" x="10" font-size="12" fill="black" y="3">platforms</text><g class="header-box-content" fill="black" transform="translate(5, 0)"><g transform="translate(0, 4.095238095238102)"><text font-size="12"><tspan x="4" y="42.4047619047619">SaaS, Office 365, Google Workspace</tspan></text></g></g></g></g></g><g transform="translate(0,97)"><g><g class="tactic initial-access" transform="translate(0, 0)"><g class="techniques"><g class="technique T1189" transform="translate(0, 30.869565217391305)"><rect class="cell" height="30.869565217391305" width="95.0909090909091" fill="#ffffff" stroke="#6B7279"/><polygon class="sidebar" transform="translate(0, 30.869565217391305)" points="0,0 12,0 12,0" fill="#6B7279" visibility="hidden"/><text font-size="7.015656565656565" fill="#000000"><tspan x="4" y="11.684782608695652">Drive-by</tspan><tspan x="4" y="26.184782608695652">Compromise</tspan></text></g><g class="technique T1566" transform="translate(0, 61.73913043478261)"><rect class="cell" height="30.869565217391305" width="95.0909090909091" fill="#ffffff" stroke="#6B7279"/><polygon class="sidebar" transform="translate(0, 30.869565217391305)" points="0,0 12,0 12,12" fill="#6B7279" visibility="visible"/><text font-size="7.015656565656565" fill="#000000"><tspan x="4" y="18.934782608695652">Phishing</tspan></text></g><g class="technique T1199" transform="translate(0, 154.34782608695653)"><rect class="cell" height="30.869565217391305" width="95.0909090909091" fill="#ffffff" stroke="#6B7279"/><polygon class="sidebar" transform="translate(0, 30.869565217391305)" points="0,0 12,0 12,0" fill="#6B7279" visibility="hidden"/><text font-size="7.015656565656565" fill="#000000"><tspan x="4" y="11.684782608695652">Trusted</tspan><tspan x="4" y="26.184782608695652">Relationship</tspan></text></g><g class="technique T1078" transform="translate(0, 185.2173913043478)"><rect class="cell" height="30.869565217391305" width="95.0909090909091" fill="#ffffff" stroke="#6B7279"/><polygon class="sidebar" transform="translate(0, 30.869565217391305)" points="0,0 12,0 12,12" fill="#6B7279" visibility="visible"/><text font-size="7.015656565656565" fill="#000000"><tspan x="4" y="11.684782608695652">Valid</tspan><tspan x="4" y="26.184782608695652">Accounts</tspan></text></g></g><g class="subtechniques"><g class="subtechnique T1566.002" transform="translate(15, 92.6086956521739)"><rect class="cell" height="30.869565217391305" width="80.0909090909091" fill="#ffffff" stroke="#6B7279"/><rect class="cell" height="30.869565217391305" width="3" transform="translate(-3, 0)" fill="#6B7279" stroke="#6B7279"/><text font-size="7.015656565656565" fill="#000000"><tspan x="4" y="10.684782608695652">Spearphishing</tspan><tspan x="4" y="25.184782608695652">Link</tspan></text></g><g class="subtechnique T1566.004" transform="translate(15, 123.47826086956