Cloud Application Integration

{
  "id": "ATTACK:enterprise:T1671",
  "title": "Cloud Application Integration",
  "type": "Technique",
  "source_url": "https://attack.mitre.org/techniques/T1671",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--c31aebd6-c9b5-420f-ba2a-5853bbf897fa",
  "external_id": "T1671",
  "domain": "enterprise",
  "created": "2025-03-20T22:21:59.326Z",
  "modified": "2025-04-15T19:59:05.283Z",
  "version": "1.0",
  "aliases": [

  ],
  "tactics": [
    "persistence"
  ],
  "source_references": [
    {
      "source_name": "Wiz Midnight Blizzard 2024",
      "url": "https://www.wiz.io/blog/midnight-blizzard-microsoft-breach-analysis-and-best-practices"
    },
    {
      "source_name": "Push Security SaaS Persistence 2022",
      "url": "https://pushsecurity.com/blog/maintaining-persistent-access-in-a-saas-first-world/"
    },
    {
      "source_name": "Push Security Slack Persistence 2023",
      "url": "https://pushsecurity.com/blog/phishing-slack-persistence/"
    },
    {
      "source_name": "Microsoft Malicious OAuth Applications 2022",
      "url": "https://www.microsoft.com/en-us/security/blog/2022/09/22/malicious-OAuth-applications-used-to-compromise-email-servers-and-spread-spam/"
    },
    {
      "source_name": "Microsoft Entra ID Service Principals",
      "url": "https://learn.microsoft.com/en-us/entra/identity-platform/app-objects-and-service-principals?tabs=browser"
    },
    {
      "source_name": "SaaS Attacks GitHub Evil Twin Integrations",
      "url": "https://github.com/pushsecurity/saas-attacks/blob/main/techniques/evil_twin_integrations/description.md"
    },
    {
      "source_name": "Huntress Persistence Microsoft 365 Compromise 2024",
      "url": "https://www.huntress.com/blog/legitimate-apps-as-traitorware-for-persistent-microsoft-365-compromise"
    },
    {
      "source_name": "Synes Cyber Corner Malicious Azure Application 2023",
      "url": "https://cybercorner.tech/malicious-azure-application-perfectdata-software-and-office365-business-email-compromise/"
    }
  ]
}