Atrás 
The phenomenal growth in the adoption of software as a service (SaaS) has prompted enterprises of all sizes to move their critical data to SaaS-based applications. And as attackers tend to follow data to induce a breach, their new area of focus is enterprise SaaS. The recent Midnight Blizzard attack by nation-state actors clearly reinforces the fact that this trend has only just begun.
One interesting aspect of this attack, as well as other recent attacks on SaaS, is that the attackers leveraged a combination of traditional attack vectors, like poor posture controls around authentication and new attack vectors, likeOAuth based applications. It’s worth mentioning that this attack vector has also recently been leveraged by opportunistic threat actors to automate both business email compromise (BEC) attacks and phishing attacks, as well as push spam and deploy virtual machines (VMs) for crypto mining. This underscores the fact that attacks on SaaS apps are not exclusive to state-sponsored groups only.
The anatomy of an OAuth attack on SaaS apps
Let’s drill into some of the tactics that attackers seem to have used in this attack:
- Initial Access via password spraying on test tenant accounts.
- Defense Evasion by