1200KM / detection
T1671 Cloud Application Integration — Detection Rules
Detection workspace for T1671 Cloud Application Integration: 0 Sigma sources, 0 Atlas concepts and 0 anomaly models. No live detection validation.
Source-backed rule directory
No reviewed association in this snapshot.
Atlas deterministic concepts
No exact concept selected.
Anomaly models
No exact Atlas model in this snapshot.
ATT&CK analytic guidance
DET0539 Detection Strategy for Cloud Application Integration
AN1487 Analytic 1487
Detects suspicious OAuth application integrations within Office 365 or Google Workspace environments, such as new app registrations, unexpected consent grants, or privilege assignments. Defenders should correlate between application creation/modification events and associated user or service principal activity to identify persistence via app integrations.
AN1488 Analytic 1488
Detects anomalous SaaS application integration activity across environments such as Slack, Salesforce, or other enterprise SaaS services. Focus is on unauthorized app additions, unusual permission grants, and persistence through service principal tokens.
Connected ecosystem references
Linked tags
Simulation, tools and telemetry
- Active Directory Object Modification · DC0066
- Application Log Content · DC0038
- Cloud Service Modification · DC0069
No reviewed association in this snapshot.
Existing anomaly research
Pinned research references. No browser attack runner, live simulation result or validated detector is asserted. Source mappings and validation limits are preserved. ATT&CK / Atomic provenance · Detection provenance.