{"source_checked_on":"2026-10-19","schema_version":1,"key":"enterprise/T1671","id":"T1671","name":"Cloud Application Integration","domain":"enterprise","reviewed_on":"2026-09-28","source_url":"https://attack.mitre.org/techniques/T1671","source_file":{"file":"enterprise.json","url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/20664a889568dce884a1dac0ec7b12ae3a199f51/enterprise-attack/enterprise-attack-20.0.json","sha256":"81113ba98afa2928f3dcff62022539f7ce30c315c32e14422f11ff95ce534352","bytes":55271014},"source_object_sha256":"f7d4fd30a71d35a129a20958be4efa734ae376e70d524af97f9795de1aa67626","description":"Adversaries may achieve persistence by leveraging OAuth application integrations in a software-as-a-service environment. Adversaries may create a custom application, add a legitimate application into the environment, or even co-opt an existing integration to achieve malicious ends.(Citation: Push Security SaaS Persistence 2022)(Citation: SaaS Attacks GitHub Evil Twin Integrations)\n\nOAuth is an open standard that allows users to authorize applications to access their information on their behalf. In a SaaS environment such as Microsoft 365 or Google Workspace, users may integrate applications to improve their workflow and achieve tasks.  \n\nLeveraging application integrations may allow adversaries to persist in an environment – for example, by granting consent to an application from a high-privileged adversary-controlled account in order to maintain access to its data, even in the event of losing access to the account.(Citation: Wiz Midnight Blizzard 2024)(Citation: Microsoft Malicious OAuth Applications 2022)(Citation: Huntress Persistence Microsoft 365 Compromise 2024) In some cases, integrations may remain valid even after the original consenting user account is disabled.(Citation: Push Security Slack Persistence 2023) Application integrations may also allow adversaries to bypass multi-factor authentication requirements through the use of [Application Access Token](https://attack.mitre.org/techniques/T1550/001)s. Finally, they may enable persistent [Automated Exfiltration](https://attack.mitre.org/techniques/T1020) over time.(Citation: Synes Cyber Corner Malicious Azure Application 2023)\n\nCreating or adding a new application may require the adversary to create a dedicated [Cloud Account](https://attack.mitre.org/techniques/T1136/003) for the application and assign it [Additional Cloud Roles](https://attack.mitre.org/techniques/T1098/003) – for example, in Microsoft 365 environments, an application can only access resources via an associated service principal.(Citation: Microsoft Entra ID Service Principals)  ","references":[{"source_name":"mitre-attack","url":"https://attack.mitre.org/techniques/T1671","external_id":"T1671"},{"source_name":"Wiz Midnight Blizzard 2024","description":"Lior Sonntag. (2024, February 8). Midnight Blizzard attack on Microsoft corporate environment: a detailed analysis, detections and recommendations. Retrieved March 20, 2025.","url":"https://www.wiz.io/blog/midnight-blizzard-microsoft-breach-analysis-and-best-practices"},{"source_name":"Push Security SaaS Persistence 2022","description":"Luke Jennings. (2022, November 29). Maintaining persistent access in a SaaS-first world. Retrieved March 20, 2025.","url":"https://pushsecurity.com/blog/maintaining-persistent-access-in-a-saas-first-world/"},{"source_name":"Push Security Slack Persistence 2023","description":"Luke Jennings. (2023, October 24). Slack Attack: A phisher's guide to persistence and lateral movement. Retrieved March 20, 2025.","url":"https://pushsecurity.com/blog/phishing-slack-persistence/"},{"source_name":"Microsoft Malicious OAuth Applications 2022","description":"Microsoft Threat Intelligence. (2022, September 22). Malicious OAuth applications abuse cloud email services to spread spam. Retrieved March 20, 2025.","url":"https://www.microsoft.com/en-us/security/blog/2022/09/22/malicious-OAuth-applications-used-to-compromise-email-servers-and-spread-spam/"},{"source_name":"Microsoft Entra ID Service Principals","description":"Microsoft. (2023, December 15). Application and service principal objects in Microsoft Entra ID. Retrieved February 28, 2024.","url":"https://learn.microsoft.com/en-us/entra/identity-platform/app-objects-and-service-principals?tabs=browser"},{"source_name":"SaaS Attacks GitHub Evil Twin Integrations","description":"Push Security. (n.d.). Evil twin integrations. Retrieved March 20, 2025.","url":"https://github.com/pushsecurity/saas-attacks/blob/main/techniques/evil_twin_integrations/description.md"},{"source_name":"Huntress Persistence Microsoft 365 Compromise 2024","description":"Sharon Martin. (2024, November 5). Legitimate Apps as Traitorware for Persistent Microsoft 365 Compromise. Retrieved March 20, 2025.","url":"https://www.huntress.com/blog/legitimate-apps-as-traitorware-for-persistent-microsoft-365-compromise"},{"source_name":"Synes Cyber Corner Malicious Azure Application 2023","description":"syne0. (2023, July 10). Malicious Azure Application PERFECTDATA SOFTWARE and Microsoft 365 Business Email Compromise. Retrieved March 20, 2025.","url":"https://cybercorner.tech/malicious-azure-application-perfectdata-software-and-office365-business-email-compromise/"}],"platforms":["Office Suite","SaaS"],"environments":["cloud","onprem","saas"],"visibility":"source_mapped","visibility_note":null,"parent":null,"children":[],"telemetry":[{"id":"DC0066","name":"Active Directory Object Modification","page":"telemetry/DC0066/","kind":"attack_component","category":"Windows and directory audit","description":"Modification of an Active Directory object attribute.","collection_focus":"Enable Audit Directory Service Changes with appropriate object SACLs on lab DCs; retain 5136 attribute/value and correlation context.","providers":[{"name":"Windows Security auditing","scope":"Policy-dependent account, object, task and logon records on the host that performs the operation.","source_id":"audit"},{"name":"Active Directory domain controllers","scope":"Directory changes and authentication records; collect from the relevant controllers, not only endpoints.","source_id":"ad"}],"configuration":["Use a lab-only GPO under Computer Configuration → Windows Settings → Security Settings → Advanced Audit Policy Configuration. Enable the specific subcategory named below.","For object-level auditing, configure a narrow system access control list (SACL) on the test object in addition to policy. Do not audit an entire production directory by default.","Forward Security events from the responsible host or controller; retain subject and target identities, object identifiers, result and original XML. Confirm effective policy with auditpol /get /category:*."],"configuration_example":null,"required_fields":["object_dn","attribute","before","after"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0066","collector":"illustrative-lab-collector","observation":{"object_dn":"CN=LabUser,OU=Lab,DC=example,DC=test","attribute":"description","before":"Lab account","after":"Lab account reviewed"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"A policy checkbox alone does not guarantee an event. Host role, SACL, success/failure selection and audit policy precedence matter. Directory changes may arrive as multiple records.","sources":[{"id":"audit","title":"Microsoft advanced security audit policy","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/advanced-security-audit-policy-settings"},{"id":"ad","title":"Microsoft Audit Directory Service Changes","url":"https://learn.microsoft.com/windows/security/threat-protection/auditing/audit-directory-service-changes"},{"id":"task","title":"Microsoft scheduled-task creation event 4698","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4698"}],"association":"attack_component","anomaly_design":"Per principal, host and object: unusual access/request rates, new principal-object relationships, and changes outside approved administration windows. Control for service accounts and scheduled directory maintenance."},{"id":"DC0038","name":"Application Log Content","page":"telemetry/DC0038/","kind":"attack_component","category":"Application and service audit","description":"Application-emitted audit or operational event content.","collection_focus":"Select the application event family required by the detection and document its native schema before normalization.","providers":[{"name":"Application audit logs","scope":"First-party service events and request/result fields; schema is application-specific.","source_id":"otel"},{"name":"OpenTelemetry-compatible log pipelines","scope":"Transport and normalization of emitted records; do not create missing audit instrumentation.","source_id":"otel"}],"configuration":["Enable the application audit category or instrument the owned lab application at the authorization/action boundary.","Define a schema with timestamp, service, actor, object, action, result and correlation ID. Export structured records through an authenticated collector.","Redact secrets and personal content, separate audit from debug logs, set retention and verify delivery during rotation/restart."],"configuration_example":null,"required_fields":["service","action","actor","record_count","result"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0038","collector":"illustrative-lab-collector","observation":{"service":"lab-portal","action":"export_requested","actor":"lab-reader","record_count":3,"result":"authorized"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Debug output is not necessarily a durable audit trail. Application developers must emit the relevant event; installing a log pipeline does not make an absent event exist.","sources":[{"id":"otel","title":"OpenTelemetry log data model","url":"https://opentelemetry.io/docs/specs/otel/logs/data-model/"}],"association":"attack_component","anomaly_design":"Per application, client and route: request rate, rare actions, failure ratios and unusual state transitions. Version changes, retries, health probes and seasonal load need separate baselines."},{"id":"DC0069","name":"Cloud Service Modification","page":"telemetry/DC0069/","kind":"attack_component","category":"Cloud control plane","description":"Changes to a managed cloud service configuration.","collection_focus":"Collect the service-specific update API and resulting configuration state; record account/project, actor and changed settings.","providers":[{"name":"AWS CloudTrail","scope":"Management-plane API activity; supported resource/data events require separate selectors.","source_id":"cloudtrail"},{"name":"Azure Monitor Activity Log","scope":"Azure resource control-plane operations; resource data-plane logs are separate.","source_id":"azure"},{"name":"Google Cloud Audit Logs","scope":"Admin Activity and other categories; configure Data Access where required.","source_id":"gcp"}],"configuration":["In the isolated account/project/subscription, route administrative audit logs to a protected destination with retention and access controls.","Select the relevant service, regions and read/write operations. Confirm whether the API below is a management or data event in the provider documentation.","Preserve actor/session, resource, request ID, service, operation, region and error details. Check delivery latency and avoid logging credentials or sensitive request bodies."],"configuration_example":null,"required_fields":["service","resource_id","attribute","before","after"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0069","collector":"illustrative-lab-collector","observation":{"service":"lab-audit-service","resource_id":"lab-service-1","attribute":"retention_days","before":7,"after":30}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"AWS, Azure and Google expose different APIs and event schemas. An accepted API request does not prove the final resource state; join asynchronous outcomes and inventory.","sources":[{"id":"cloudtrail","title":"AWS CloudTrail event categories","url":"https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-events.html"},{"id":"ec2","title":"AWS EC2 API logging with CloudTrail","url":"https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/monitor-with-cloudtrail.html"},{"id":"azure","title":"Azure Monitor Activity Log","url":"https://learn.microsoft.com/en-us/azure/azure-monitor/fundamentals/activity-log"},{"id":"gcp","title":"Google Cloud Audit Logs","url":"https://docs.cloud.google.com/logging/docs/audit"}],"association":"attack_component","anomaly_design":"Per account, role, region and API: rare actions, new role-resource relationships, enumeration bursts and configuration changes. Separate deployment automation and organization-level administrative activity."}],"detection":{"key":"enterprise/T1671","id":"T1671","name":"Cloud Application Integration","domain":"enterprise","platforms":["Office Suite","SaaS"],"environments":["cloud","onprem","saas"],"source_url":"https://attack.mitre.org/techniques/T1671","technique_page":"techniques/enterprise/T1671/","page":"detections/enterprise/T1671/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":2,"live_validated":0},"sigma_rules":[],"atlas_basic":[],"atlas_anomaly":[],"anomaly_types":[],"strategies":[{"id":"DET0539","name":"Detection Strategy for Cloud Application Integration","url":"https://attack.mitre.org/detectionstrategies/DET0539","stix_id":"x-mitre-detection-strategy--8bc479cf-727b-40d1-92d2-5755766d8544","relationship_id":"relationship--7fd5057e-fa4f-45ee-99cc-ca792cd8412f","description":"","analytics":[{"id":"AN1487","name":"Analytic 1487","guidance":"Detects suspicious OAuth application integrations within Office 365 or Google Workspace environments, such as new app registrations, unexpected consent grants, or privilege assignments. Defenders should correlate between application creation/modification events and associated user or service principal activity to identify persistence via app integrations.","url":"https://attack.mitre.org/detectionstrategies/DET0539#AN1487","platforms":["Office Suite"],"tuning":[{"field":"PrivilegedUserList","description":"Defines which accounts are authorized to consent or register applications; deviations indicate possible adversary persistence."},{"field":"ApplicationScopeThreshold","description":"Defines which OAuth scopes are considered risky (e.g., Mail.ReadWrite, Files.ReadWrite.All)."}],"log_sources":[{"component_id":"DC0066","component":"Active Directory Object Modification","name":"m365:unified","channel":"Add app role assignment grant to user: Consent to application by privileged or unexpected accounts","platforms":["Office Suite"],"analytic_id":"AN1487","source_url":"https://attack.mitre.org/detectionstrategies/DET0539#AN1487","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0066/"},{"component_id":"DC0069","component":"Cloud Service Modification","name":"azure:audit","channel":"Consent to application: OAuth application consent granted to service principal","platforms":["Office Suite"],"analytic_id":"AN1487","source_url":"https://attack.mitre.org/detectionstrategies/DET0539#AN1487","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0069/"}]},{"id":"AN1488","name":"Analytic 1488","guidance":"Detects anomalous SaaS application integration activity across environments such as Slack, Salesforce, or other enterprise SaaS services. Focus is on unauthorized app additions, unusual permission grants, and persistence through service principal tokens.","url":"https://attack.mitre.org/detectionstrategies/DET0539#AN1488","platforms":["SaaS"],"tuning":[{"field":"AppWhitelist","description":"Defines approved SaaS integrations for the enterprise; deviations indicate suspicious persistence."},{"field":"ConsentDelegationPolicy","description":"Threshold for which users can self-consent integrations; lowering this may reduce false positives."}],"log_sources":[{"component_id":"DC0069","component":"Cloud Service Modification","name":"saas:integration","channel":"New or modified third-party application integrations with elevated permissions","platforms":["SaaS"],"analytic_id":"AN1488","source_url":"https://attack.mitre.org/detectionstrategies/DET0539#AN1488","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0069/"},{"component_id":"DC0038","component":"Application Log Content","name":"saas:audit","channel":"Application added or consent granted: Integration persisting after original user disabled","platforms":["SaaS"],"analytic_id":"AN1488","source_url":"https://attack.mitre.org/detectionstrategies/DET0539#AN1488","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0038/"}]}]}],"telemetry_references":[{"id":"DC0066","name":"Active Directory Object Modification","tag":"Active Directory Object Modification","page":"telemetry/DC0066/","kind":"attack_component"},{"id":"DC0038","name":"Application Log Content","tag":"Application Log Content","page":"telemetry/DC0038/","kind":"attack_component"},{"id":"DC0069","name":"Cloud Service Modification","tag":"Cloud Service Modification","page":"telemetry/DC0069/","kind":"attack_component"}],"visibility":"source_mapped","visibility_note":null,"tool_references":[],"related_parent":null,"article_url":"https://1200km.com/articles/read/2026/2026-04-20-malicious-activity-as-a-statistical-signal-a-detection-engineering-analysis-of-anomaly-bas-90df8b6dea12/","validation":{"source_join":"exact_ids","sigma_yaml":"parsed","backend_compilation":"not_run","live_telemetry":"not_run","detection_execution":"not_run"}},"tools":[],"software":[],"actors":[],"mitigations":[{"id":"M1042","name":"Disable or Remove Feature or Program","url":"https://attack.mitre.org/mitigations/M1042","kind":"course-of-action","description":"Do not allow users to add new application integrations into a SaaS environment. In Entra ID environments, consider enforcing the “Do not allow user consent” option.(Citation: Microsoft Entra Configure OAuth Consent)","relationship_id":"relationship--03a0056f-4d2f-4ef2-b33f-907e6ef30aa9","references":[{"source_name":"Microsoft Entra Configure OAuth Consent","description":"Microsoft Entra. (2024, September 16). Configure how users consent to applications. Retrieved March 20, 2025.","url":"https://learn.microsoft.com/en-us/entra/identity/enterprise-apps/configure-user-consent?pivots=portal"}]},{"id":"M1047","name":"Audit","url":"https://attack.mitre.org/mitigations/M1047","kind":"course-of-action","description":"Periodically review SaaS integrations for unapproved or potentially malicious applications.  ","relationship_id":"relationship--4797263a-01a0-4053-ae5c-54cf53217e97","references":[]}],"candidates":[],"simulation":{"atomic_status":"no_atomic_candidate","lab_execution":"not_run","browser_attack_runner":false,"prerequisites":"Use disposable lab hosts and test accounts, explicit target allowlists, a clean snapshot, bounded egress and a restore plan. Review every candidate and dependency before any execution.","scenario":null},"validation":{"source_identity":"checked_against_pinned_source","relationship_join":"exact_ids_no_inheritance","page_contract":"automated_checks_required","sensor_capture":"not_run","detection_backend":"not_run","adversary_simulation":"not_run","independent_incident_fact_check":"not_performed"},"technique_links":{"T1550.001":"/ttp-simulation/techniques/enterprise/T1550.001/","T1020":"/ttp-simulation/techniques/enterprise/T1020/","T1136.003":"/ttp-simulation/techniques/enterprise/T1136.003/","T1098.003":"/ttp-simulation/techniques/enterprise/T1098.003/","T1671":"/ttp-simulation/techniques/enterprise/T1671/"},"synthetic":{"schema":"1200km.ttp.collection-fixture.v1","synthetic":true,"technique_key":"enterprise/T1671","purpose":"Collection/parser contract exercise, NOT a positive example or detection of this TTP.","events":[{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0066","collector":"illustrative-lab-collector","observation":{"object_dn":"CN=LabUser,OU=Lab,DC=example,DC=test","attribute":"description","before":"Lab account","after":"Lab account reviewed"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0038","collector":"illustrative-lab-collector","observation":{"service":"lab-portal","action":"export_requested","actor":"lab-reader","record_count":3,"result":"authorized"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0069","collector":"illustrative-lab-collector","observation":{"service":"lab-audit-service","resource_id":"lab-service-1","attribute":"retention_days","before":7,"after":30}}]}}