From e47e86ab9840f5351d79f016bfb62307ef13677b Mon Sep 17 00:00:00 2001 From: Omar Santos Date: Sun, 5 May 2024 16:57:32 -0400 Subject: [PATCH] Update and rename Figure4-2.svg to attack_saas.svg --- cloud_resources/{Figure4-2.svg => attack_saas.svg} | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) rename cloud_resources/{Figure4-2.svg => attack_saas.svg} (99%) diff --git a/cloud_resources/Figure4-2.svg b/cloud_resources/attack_saas.svg similarity index 99% rename from cloud_resources/Figure4-2.svg rename to cloud_resources/attack_saas.svg index 81b614a..20cd38d 100644 --- a/cloud_resources/Figure4-2.svg +++ b/cloud_resources/attack_saas.svg @@ -1,2 +1,2 @@ -aboutOmar's SaaSMITREATT&CK TTPs for SaaS implementationsdomainEnterprise ATT&CK v15platformsSaaS, Office 365, Google WorkspaceDrive-byCompromisePhishingTrustedRelationshipValidAccountsSpearphishingLinkSpearphishingVoiceCloudAccountsDefaultAccountsInitialAccessCommandand ScriptingInterpreterServerlessExecutionSoftwareDeploymentToolsCloudAPIExecutionAccountManipulationCreateAccountEvent TriggeredExecutionModifyAuthenticationProcessOfficeApplicationStartupValidAccountsAdditionalCloudCredentialsAdditionalCloud RolesAdditionalEmail DelegatePermissionsDeviceRegistrationCloudAccountConditionalAccessPoliciesHybridIdentityMulti-FactorAuthenticationAdd-insOfficeTemplateMacrosOfficeTestOutlookFormsOutlookHome PageOutlookRulesCloudAccountsDefaultAccountsPersistenceAbuse ElevationControlMechanismAccountManipulationDomain orTenant PolicyModificationEvent TriggeredExecutionValidAccountsTemporaryElevatedCloud AccessAdditionalCloudCredentialsAdditionalCloud RolesAdditionalEmail DelegatePermissionsDeviceRegistrationTrustModificationCloudAccountsDefaultAccountsPrivilegeEscalationAbuse ElevationControlMechanismDomain orTenant PolicyModificationExploitationforDefense EvasionHideArtifactsImpairDefensesImpersonationIndicatorRemovalModifyAuthenticationProcessUse AlternateAuthenticationMaterialValidAccountsTemporaryElevatedCloud AccessTrustModificationEmailHiding RulesDisableor ModifyCloud LogsClearMailbox DataConditionalAccessPoliciesHybridIdentityMulti-FactorAuthenticationApplicationAccess TokenWeb SessionCookieCloudAccountsDefaultAccountsDefenseEvasionBruteForceForge WebCredentialsModifyAuthenticationProcessMulti-FactorAuthenticationRequest GenerationStealApplicationAccess TokenSteal WebSession CookieUnsecuredCredentialsCredentialStuffingPasswordCrackingPasswordGuessingPasswordSprayingSAMLTokensWebCookiesConditionalAccessPoliciesHybridIdentityMulti-FactorAuthenticationChatMessagesCredentialAccessAccountDiscoveryCloud ServiceDashboardCloud ServiceDiscoveryPermissionGroupsDiscoveryCloudAccountEmailAccountCloudGroupsDiscoveryInternalSpearphishingSoftwareDeploymentToolsTaint SharedContentUse AlternateAuthenticationMaterialApplicationAccess TokenWeb SessionCookieLateralMovementAutomatedCollectionData fromCloud StorageData fromInformationRepositoriesEmailCollectionCodeRepositoriesConfluenceSharepointEmailForwardingRuleRemote EmailCollectionCollectionExfiltrationOver AlternativeProtocolExfiltrationOverWeb ServiceTransferData toCloud AccountExfiltrationOver WebhookExfiltrationAccountAccess RemovalEndpoint Denialof ServiceFinancialTheftNetwork Denialof ServiceApplicationExhaustionFloodApplicationor SystemExploitationServiceExhaustionFloodDirectNetworkFloodReflectionAmplificationImpact \ No newline at end of file +aboutOmar's SaaSMITREATT&CK TTPs for SaaS implementationsdomainEnterprise ATT&CK v15platformsSaaS, Office 365, Google WorkspaceDrive-byCompromisePhishingTrustedRelationshipValidAccountsSpearphishingLinkSpearphishingVoiceCloudAccountsDefaultAccountsInitialAccessCommandand ScriptingInterpreterServerlessExecutionSoftwareDeploymentToolsCloudAPIExecutionAccountManipulationCreateAccountEvent TriggeredExecutionModifyAuthenticationProcessOfficeApplicationStartupValidAccountsAdditionalCloudCredentialsAdditionalCloud RolesAdditionalEmail DelegatePermissionsDeviceRegistrationCloudAccountConditionalAccessPoliciesHybridIdentityMulti-FactorAuthenticationAdd-insOfficeTemplateMacrosOfficeTestOutlookFormsOutlookHome PageOutlookRulesCloudAccountsDefaultAccountsPersistenceAbuse ElevationControlMechanismAccountManipulationDomain orTenant PolicyModificationEvent TriggeredExecutionValidAccountsTemporaryElevatedCloud AccessAdditionalCloudCredentialsAdditionalCloud RolesAdditionalEmail DelegatePermissionsDeviceRegistrationTrustModificationCloudAccountsDefaultAccountsPrivilegeEscalationAbuse ElevationControlMechanismDomain orTenant PolicyModificationExploitationforDefense EvasionHideArtifactsImpairDefensesImpersonationIndicatorRemovalModifyAuthenticationProcessUse AlternateAuthenticationMaterialValidAccountsTemporaryElevatedCloud AccessTrustModificationEmailHiding RulesDisableor ModifyCloud LogsClearMailbox DataConditionalAccessPoliciesHybridIdentityMulti-FactorAuthenticationApplicationAccess TokenWeb SessionCookieCloudAccountsDefaultAccountsDefenseEvasionBruteForceForge WebCredentialsModifyAuthenticationProcessMulti-FactorAuthenticationRequest GenerationStealApplicationAccess TokenSteal WebSession CookieUnsecuredCredentialsCredentialStuffingPasswordCrackingPasswordGuessingPasswordSprayingSAMLTokensWebCookiesConditionalAccessPoliciesHybridIdentityMulti-FactorAuthenticationChatMessagesCredentialAccessAccountDiscoveryCloud ServiceDashboardCloud ServiceDiscoveryPermissionGroupsDiscoveryCloudAccountEmailAccountCloudGroupsDiscoveryInternalSpearphishingSoftwareDeploymentToolsTaint SharedContentUse AlternateAuthenticationMaterialApplicationAccess TokenWeb SessionCookieLateralMovementAutomatedCollectionData fromCloud StorageData fromInformationRepositoriesEmailCollectionCodeRepositoriesConfluenceSharepointEmailForwardingRuleRemote EmailCollectionCollectionExfiltrationOver AlternativeProtocolExfiltrationOverWeb ServiceTransferData toCloud AccountExfiltrationOver WebhookExfiltrationAccountAccess RemovalEndpoint Denialof ServiceFinancialTheftNetwork Denialof ServiceApplicationExhaustionFloodApplicationor SystemExploitationServiceExhaustionFloodDirectNetworkFloodReflectionAmplificationImpact