tfMITRE ATT&CK technique

Cloud Application Integration T1671

Tactic: Persistence
Platforms: Office Suite, SaaS
Version: 1.0
Created: 20 March 2025
Last modified: 15 April 2025

Adversaries may achieve persistence by leveraging OAuth application integrations in a software-as-a-service environment. Adversaries may create a custom application, add a legitimate application into the environment, or even co-opt an existing integration to achieve malicious ends.[1][2]

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groupsNone recorded

Threat groupsNone recorded · 29% of ATT&CK techniques have none either.

Campaigns72nd pct

Campaigns72nd percentile · 72% of ATT&CK techniques have this many campaigns recorded or fewer.

Tools & malwareNone recorded

Tools & malwareNone recorded · 29% of ATT&CK techniques have none either.

Detection rulesNone recorded

Detection rulesNone recorded · 33% of ATT&CK techniques have none either.

Cloud Application Integration MITRE reference T1671

72nd pctamong all ATT&CK techniques for number of campaigns

1 campaign has been recorded using this technique. Listed newest first; dates are year-granularity and attribution is MITRE’s.

Salesforce Data ExfiltrationC0059 ↗

During Salesforce Data Exfiltration, threat actors deceived victims into authorizing malicious connected apps to their organization's Salesforce portal.1 2

2004–2025

All 1 campaigns for this technique

Offense vs defense T1671

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

Cloud Application Integration detection strategy DET0539

MITRE names one behaviour worth catching for this technique and breaks it into 2 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Detection Strategy for Cloud Application Integration

Enterprise

2 platforms

AN1487 · Office Suite

Detects suspicious OAuth application integrations within Office 365 or Google Workspace environments, such as new app registrations, unexpected consent grants, or privilege assignments. Defenders should correlate between application creation/modification events and associated user or service principal activity to identify persistence via app integrations.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Active Directory Object ModificationDC0066	m365:unified	Add app role assignment grant to user: Consent to application by privileged or unexpected accounts
Cloud Service ModificationDC0069	azure:audit	Consent to application: OAuth application consent granted to service principal

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
PrivilegedUserList	Defines which accounts are authorized to consent or register applications; deviations indicate possible adversary persistence.
ApplicationScopeThreshold	Defines which OAuth scopes are considered risky (e.g., Mail.ReadWrite, Files.ReadWrite.All).

AN1488 · SaaS

Detects anomalous SaaS application integration activity across environments such as Slack, Salesforce, or other enterprise SaaS services. Focus is on unauthorized app additions, unusual permission grants, and persistence through service principal tokens.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Application Log ContentDC0038	saas:audit	Application added or consent granted: Integration persisting after original user disabled
Cloud Service ModificationDC0069	saas:integration	New or modified third-party application integrations with elevated permissions

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
AppWhitelist	Defines approved SaaS integrations for the enterprise; deviations indicate suspicious persistence.
ConsentDelegationPolicy	Threshold for which users can self-consent integrations; lowering this may reduce false positives.

Cloud Application Integration detections T1671

No detection rules are mapped to this technique yet.

None recorded— 33% of ATT&CK techniques have none either

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs