T1671 — Cloud Application Integration

Tactic: Persistence · Platforms: Office Suite, SaaS

Adversaries may achieve persistence by leveraging OAuth application integrations in a software-as-a-service environment. Adversaries may create a custom application, add a legitimate application into the environment, or even co-opt an existing integration to achieve malicious ends. OAuth is an…

Sigma detection rules (2)

T1671 Cloud Application Integration

title: T1671 Cloud Application Integration
id: 3ed47cb6-f41d-4d52-a2cf-808ac22d12c7
description: 'Detection Strategy for Cloud Application Integration. (Data Component: Cloud Service Modification; baseline tier: fallback.) Tune using: AppWhitelist, ConsentDelegationPolicy.'
references:
  - https://attack.mitre.org/techniques/T1671
author: Shahrukh Khan
date: 2026-01-13
license: MIT
tags:
  - attack.persistence
  - attack.t1671

logsource:
  product: saas
  service: integration

detection:
  selection:
    event_type: 'integration_enabled'

  condition: selection

falsepositives:
  - An IT-approved rollout of a new marketplace integration during onboarding of an approved business tool.

level: medium

T1671 Cloud Application Integration

title: T1671 Cloud Application Integration
id: 9813f6b8-61c3-446f-829c-921bfe808984
description: 'Detection Strategy for Cloud Application Integration. (Data Component: Active Directory Object Modification; baseline tier: fallback.) Tune using: PrivilegedUserList, ApplicationScopeThreshold.'
references:
  - https://attack.mitre.org/techniques/T1671
author: Shahrukh Khan
date: 2026-01-07
license: MIT
tags:
  - attack.persistence
  - attack.t1671

logsource:
  product: m365
  service: unified

detection:
  selection:
    Operation:
      - 'Add service principal'
      - 'Add service principal credentials'
      - 'Add app role assignment to service principal'

  condition: selection

falsepositives:
  - Approved DevOps pipelines registering new service principals for legitimate application deployments.

level: high

Explore