Poisoned Pipeline / Techniques / T0174
SaaS sprawl
SaaS (Software as a Service) sprawl refers to a defense evasion tactic where an attacker takes advantage of the lack of visibility and control in a cloud environment to spread the use of unauthorized SaaS applications across an organization.
In this attack, an attacker might use a compromised user account or exploit a vulnerability to gain access to a cloud environment, then begin to sign up for and use various SaaS applications without the knowledge or approval of the organization's IT and security teams.
This can lead to a "sprawl" of unapproved SaaS applications being used throughout the organization, creating security risks and potentially violating compliance regulations.
The use of unauthorized SaaS applications can increase the attack surface and make it more difficult for security teams to monitor and protect the organization's data and systems.
Additionally, the use of these applications may introduce security vulnerabilities that can be exploited by attackers.
Where this idea came from
Cited from a security article or vendor blog in the original YAML; not a first-party incident report.
Mitigations
- M1550 Implement strict access control for clouds
- M1740 Establish guidelines for the use of SaaS application
- M1741 Implement access controls and permissions for SaaS applications
Detections
- D1510 Implement Intrusion Detection System and anti-malware