The New SaaS Cyber Kill Chain

The New SaaS Cyber Kill Chain

Speakers: Luke Jennings, Push Security

Conference: Hacktivity

YouTube: https://www.youtube.com/watch?v=qNsqQsq3nII

Overview

In "The New SaaS Cyber Kill Chain," Luke Jennings of Push Security delivers a compelling exploration of the evolving threat landscape, asserting that cloud identities have become the new perimeter in an increasingly SaaS-native world. The talk challenges traditional notions of offensive security, particularly for organizations that have largely shed on-premise infrastructure, focusing instead on how to achieve organizational compromise without ever touching an endpoint. This paradigm shift necessitates a re-evaluation of established attack methodologies and defensive strategies.

Jennings' presentation is particularly relevant in an era defined by rapid SaaS adoption, accelerated by remote work trends. As startups operate entirely within SaaS ecosystems and large enterprises rapidly migrate their operations, the attack surface has fundamentally transformed. This talk serves as a critical guide for both offensive and defensive security professionals, highlighting the unique vulnerabilities and attack vectors inherent in SaaS environments and proposing a new framework to understand and counter these threats.

Background

▶ Watch: Introduction and the New SaaS Cyber Kill Chain (0:00)

Luke Jennings' journey through offensive security, EDR development, and now SaaS security provides a unique lens through which to view the evolution of cyberattacks. He traces the historical shifts in the industry, starting from the mid-2000s, an era dominated by perimeter hacking involving port scanners and vulnerability scanners, countered by firewalls, DMZs, and patch management. The 2010s saw a pivot to the endpoint as the new perimeter, characterized by sophisticated phishing, file format bugs, Office macros, and the rise of memory-resident implants and Command and Control (C2) frameworks, which in turn spurred the growth of the EDR market.

Looking forward from 2020, Jennings posits that cloud identities are undeniably the new perimeter. This shift is driven by two primary forces: the continuous improvement of security controls, which forces attackers to innovate, and broader technological shifts like the proliferation of web applications, Wi-Fi, remote work, and crucially, the ubiquitous adoption of SaaS-native organizations. The COVID-19 pandemic significantly accelerated this trend, leading to a landscape where many startups operate without any internal infrastructure, relying solely on MacBooks and SaaS services. Even large enterprises are rapidly migrating, often grappling with the complexities of Shadow SaaS – unauthorized applications used by employees, expanding the attack surface beyond IT's awareness.

This transformation has fundamentally altered the traditional infrastructure model. Where once an internal network, DMZ, and VPNs were central, the modern SaaS-native environment consists of hardened laptops connecting directly to a multitude of SaaS services, often with intricate OAuth integrations between them. While the MITRE ATT&CK framework remains a useful high-level model, Jennings argues that its lower-level techniques require significant adaptation. Specifically, Command and Control as traditionally understood (bypassing firewalls, encoding traffic) is largely obsolete in SaaS, as APIs are designed for internet accessibility. Similarly, Execution shifts away from native code execution on operating systems towards no-code/low-code automation platforms.

Key Findings

▶ Watch: Initial access: Credential stuffing & consent phishing (9:00)

Jennings' research culminates in several critical findings that redefine the modern cyber kill chain for SaaS environments:

• Cloud Identities as the New Perimeter: The central thesis is that traditional perimeter and endpoint security are insufficient. Attackers now target user accounts and their associated permissions across various SaaS applications.
• SaaS-Specific Attack Techniques: The talk demonstrates that while some attacks are familiar (e.g., credential stuffing, phishing), many have evolved with new flavors specific to SaaS. More importantly, entirely new attack vectors, such as Poison Tenants and SAML Jacking, leverage the inherent features and trust models of SaaS platforms.
• Redefined Command and Control and Execution: Traditional C2 is largely replaced by direct interaction with SaaS APIs, which are inherently internet-accessible. Execution, in the absence of native code execution, manifests as the manipulation of no-code/low-code automation platforms to create "Shadow Workflows," effectively becoming the "offensive PowerShell for SaaS."
• Persistence is a Defender's Nightmare: The sheer number and diversity of SaaS applications present an overwhelming challenge for incident responders. Attackers can establish persistence through myriad methods—including OAuth permissions, API keys, link sharing, and ghost logins—across potentially hundreds of disparate services, making comprehensive remediation incredibly difficult.
• Lateral Movement Transforms: With no traditional internal network, lateral movement shifts from infrastructure-to-infrastructure to app-to-app or cloud identity-to-cloud identity. This involves leveraging compromised credentials or existing integrations to gain access to further SaaS services.
• The SaaS Attack Matrix: To address the need for a structured understanding of these new techniques, Jennings introduces a new SaaS Attack Matrix. This framework, analogous to MITRE ATT&CK but entirely focused on SaaS, aims to document techniques for owning an organization without touching the endpoint, providing a valuable resource for red and blue teams.

Technical Deep Dive

▶ Watch: Persistence in SaaS: A nightmare for incident responders (19:00)

Jennings delves into specific technical attack techniques across several phases of the kill chain, illustrating how adversaries can exploit SaaS environments.

Reconnaissance

The initial phase shifts from traditional port scanning to identifying an organization's SaaS footprint.

• SaaS Solution Identification: Determining which SaaS applications an organization uses.
• Cloud Identity Enumeration: Identifying valid user accounts within those SaaS services.
• SSO Enumeration: Ascertaining if and how Single Sign-On (SSO) is implemented.
• SAML Enumeration: Attackers can test email domains against SaaS login pages that support SAML for SSO. For example, testing an email domain against a service like Ramps can reveal if it's configured for SSO and potentially expose the organization's Okta unique identifier, directing attackers to their SSO portal.
• Slug Tenant Enumeration: Many SaaS applications allow organizations to choose a unique "slug" or tenant name (e.g., bamboo.com/soundcloud). By testing common company names, attackers can identify active tenants, which may redirect to custom login pages or reveal default social login configurations (e.g., Google login for SoundCloud's BambooHR tenant).

Initial Access

This phase focuses on gaining the first foothold in a SaaS environment.

• Credential Stuffing: While an old technique, its impact is magnified by the sheer number of SaaS applications an organization might use. Attackers can "shotgun" stolen or leaked credentials across dozens or hundreds of SaaS apps, exploiting varying password and lockout policies to gain access to fringe services, which can then serve as an initial foothold.
• Consent Phishing (OAuth): Instead of stealing credentials, this attack tricks users into granting an attacker-controlled OAuth application permissions to their SaaS accounts (e.g., Azure). The key advantage is the use of legitimate domains (e.g., Microsoft), permanent access (bypassing password changes or MFA resets), and the difficulty for users to discern malicious intent.
• Instant Messenger (IM) and SaaS App Phishing: With platforms like Slack Connect and Teams external access opening up, IM apps have become new phishing vectors. They often lack the sophisticated link preview scrutiny of email clients, allowing attackers to spoof link previews effectively (e.g., a link preview showing a blog post actually leading to a phishing site). User impersonation is also easier on these platforms.
• Poison Tenants: A novel attack where the adversary sets up their own tenant on a legitimate SaaS application (e.g., a marketing tool, a wiki). They then use the SaaS app's native email invitation functionality to trick target users into joining their controlled tenant. This leverages the trust associated with the legitimate SaaS domain, making it harder for users to detect. Once users join, the attacker gains control over any data or communications within that tenant.
• SAML Jacking: Exploiting SaaS applications that allow tenants to configure their SSO login process to redirect to an arbitrary URL. An attacker registers a tenant, sets its SAML configuration to point to their phishing site, and then sends the target a legitimate SaaS login URL. When the user attempts to log in via SSO, they are seamlessly redirected to the attacker's fake login page, making detection extremely difficult due to the initial trusted URL.

Persistence

Maintaining access is uniquely challenging for defenders in SaaS, given the multitude of persistence vectors.

• OAuth Integrations: Beyond consent phishing, OAuth can be used for persistence. If an attacker temporarily compromises an account, they can self-approve an OAuth application, ensuring continued access even if the user changes their password or MFA.
• Living Off The Land (LOTL) OAuth: Attackers can leverage legitimate, well-known SaaS apps (e.g., Canva) that offer integrations with other services (e.g., OneDrive). By connecting Canva to a compromised user's OneDrive, the attacker gains GUI-based access to files without creating suspicious custom OAuth apps.
• Impersonating Client-Side Apps: Mobile and desktop clients often use OAuth and cannot adequately protect their client secrets. Attackers can extract these secrets (e.g., from Thunderbird) to emulate the client, gaining full API control while appearing as a legitimate integration, making detection much harder.
• API Keys: Many SaaS applications, even at the standard user level, allow the creation of API keys. An attacker can generate a new API key for a compromised account, providing backdoor access that the legitimate user is unlikely to discover (e.g., Shortcut ticketing system).
• Link Sharing: Ubiquitous in collaboration tools (OneDrive, Google Drive), attackers can create public or internal share links for sensitive files or entire root folders. Many SaaS apps do not make it obvious when content is widely shared (e.g., Nuclino wiki pages can be shared with external links, which an API could be used to mass-create).
• Ghost Logins: The ability to add multiple login methods to a single user account. This includes setting a local password on an account primarily used with social login (e.g., Shortcut), linking additional social accounts (e.g., IFTTT), or adding secondary email addresses for login (e.g., Expensify). Attackers can add their own login method, providing stealthy, persistent access.

Execution

The traditional concept of code execution is replaced by manipulating automation.

• Shadow Workflows: This is the "offensive PowerShell of SaaS." Attackers leverage no-code/low-code automation platforms (e.g., Microsoft Power Automate, Zapier, Make, IFTTT) to create malicious workflows. These platforms allow the creation of triggers and actions across various integrated SaaS apps, enabling data exfiltration, manipulation, or further attacks without executing code on an endpoint.

Defense Evasion

Stealth is paramount for persistence and execution.

• Evil Twin Integrations: To evade detection, attackers integrate an OAuth app that is already in use by the organization or the target user. If a security team monitors for new OAuth integrations, an "evil twin" integration blends in, as the application itself (e.g., Zapier) is already whitelisted and trusted.

Lateral Movement

In a SaaS-native world, lateral movement is about moving between applications and cloud identities.

• Link Backdooring: Compromising a SaaS account (e.g., a wiki) and modifying existing, trusted links within that application to redirect to phishing sites or malicious content. This turns the SaaS app into a watering hole.
• Account Recovery Abuse: Gaining access to a user's primary email (via SSO compromise or consent phishing) enables attackers to initiate password resets or passwordless logins on numerous other SaaS platforms that use email for account recovery.
• Abusing Existing Integrations: Leveraging pre-existing OAuth connections. For instance, if a user once connected a trial Canva account to their OneDrive and then forgot about it, a compromise of that Canva account could grant the attacker access to the OneDrive, even if Canva itself holds no valuable data. Similarly, compromising a Zapier account grants control over all its existing integrations.

Demo / Proof of Concept

▶ Watch: DEMO: Shadow workflow & evil twin integration (30:00)

Jennings presented two illustrative attack chains demonstrating the practical application of these SaaS-specific techniques.

Demo 1: Poison Tenant and SAML Jacking (Nuclino)

This demonstration showcased how an attacker could combine Poison Tenants and SAML Jacking for highly effective credential harvesting.

1. Poison Tenant Setup: The attacker creates a tenant on Nuclino, a SaaS-based wiki, and configures it maliciously.
2. Legitimate Invitation: The attacker uses Nuclino's built-in email invite feature to send a legitimate-looking email from Nuclino's domain to the target user, inviting them to join the attacker's "poison tenant."
3. Account Creation: The target user, seeing a legitimate email and domain, creates an account on Nuclino and joins the poison tenant.
4. SAML Jacking Configuration: The attacker then configures the poison tenant's SSO settings to use SAML, pointing the login redirect URL to an attacker-controlled phishing site (e.g., a fake Google login page hosted on engro.com for the demo, but a more convincing domain in a real attack).
5. Phishing via SSO:

• Direct Email: The attacker forces SSO enforcement, which triggers Nuclino to send a legitimate email to existing users, prompting them to link their accounts to their SSO identity. Clicking this link immediately redirects the user to the attacker's fake login page.
• Session Expiration: Alternatively, if the user's Nuclino session expires, future login attempts via the tenant-specific login page will present a prominent "Login via SSO" button. Clicking this also redirects the user to the attacker's phishing site.

This chain leverages the trust in legitimate SaaS domains and the seamless nature of SSO redirects to compromise user credentials.

Demo 2: Shadow Workflow and Evil Twin Integration (Azure, Zapier, OneDrive, Google Drive)

This proof of concept illustrated a stealthy method of data exfiltration and persistence using automation platforms.

1. Compromised Azure Account: The attack begins with temporary access to a compromised Azure account.
2. OAuth Enumeration: The attacker enumerates existing OAuth integrations for the compromised user, identifying Zapier as a powerful automation app with existing permissions for file access (OneDrive) and email (Outlook).
3. Zapier Account Access: The attacker logs into the compromised user's Zapier account (if possible via SSO/social login) to understand existing workflows (e.g., forwarding expenses from Outlook to OneDrive).
4. Evil Twin Integration: Instead of modifying an existing workflow (which might be discovered), the attacker creates a new, separate Zapier account under their control.
5. Shadow Workflow Creation: In their own Zapier account, the attacker creates a new "zap" (workflow):

• Trigger: A new file being created in the compromised user's OneDrive. This leverages the existing OAuth permissions already granted by the user to Zapier, so no new consent is needed.
• Action: Upload the new file to the attacker's Google Drive account.

1. Data Exfiltration: When a new confidential file is created in the compromised user's OneDrive, Zapier automatically copies it to the attacker's Google Drive.

The stealth of this attack lies in the evil twin integration: no new application consent logs are generated, and the activity appears as standard Zapier usage by the user. This persistence method remains active even if the user changes their password, offering a powerful and difficult-to-detect exfiltration channel.

Defensive Implications

▶ Watch: Key takeaways: Hybrid SaaS, persistence, and new techniques (39:00)

The insights presented by Luke Jennings necessitate a significant shift in defensive strategies for organizations.

• Embrace Cloud Identity Security: Defenders must prioritize securing cloud identities, treating them as the primary perimeter. This includes robust Multi-Factor Authentication (MFA), strong password policies, and continuous monitoring of identity providers (IdPs) like Okta or Azure AD.
• Comprehensive SaaS Inventory and Monitoring: Organizations need a complete and up-to-date inventory of all SaaS applications in use, including Shadow SaaS. This requires discovery tools and continuous monitoring for new SaaS subscriptions or integrations.
• OAuth Application Governance: Implement strict governance around OAuth applications. Regularly audit granted permissions, identify suspicious or unused apps, and educate users about consent phishing. Tools should be in place to detect new or overly permissive OAuth grants, especially those that might be "evil twin" integrations.
• API Key Management: Enforce strict lifecycle management for API keys, including regular rotation, least privilege, and monitoring for unusual API key usage.
• Link Sharing Controls: Review and enforce policies around external link sharing in collaboration SaaS apps. Implement data loss prevention (DLP) solutions that can monitor shared content for sensitive information.
• Ghost Login Detection: Monitor for changes in authentication methods for user accounts. Alert on new local passwords being set for SSO-only accounts or the linking of new social identities.
• No-Code/Low-Code Platform Security: Treat no-code/low-code automation platforms (e.g., Zapier, Power Automate) as critical infrastructure. Monitor for suspicious workflows ("Shadow Workflows"), enforce least privilege for integrations, and audit existing automations for malicious intent.
• SaaS-Specific Incident Response: Develop incident response playbooks tailored for SaaS environments. Traditional endpoint-focused IR will be ineffective. Focus on revoking OAuth tokens, API keys, shared links, and investigating automation platforms. The distributed nature of SaaS persistence makes comprehensive remediation challenging and requires specialized tools and expertise.
• Utilize a SaaS Attack Matrix: Blue teams should leverage frameworks like the SaaS Attack Matrix introduced by Jennings to understand, detect, and mitigate SaaS-specific attack techniques. This provides a structured approach to identifying gaps in current defenses.
• User Education: Continuous and targeted user education is paramount, focusing on the nuances of SaaS security, such as recognizing consent phishing, understanding link previews in IM apps, and the dangers of joining unfamiliar SaaS tenants.

Key Takeaways

• The cybersecurity landscape is rapidly shifting towards hybrid and SaaS-native environments, with cloud identities becoming the new perimeter.
• Attackers are increasingly employing SaaS-orientated attack techniques that do not require traditional endpoint compromises.
• SaaS environments introduce a vast array of new persistence methods, posing a significant challenge for incident responders and offering new avenues for traditional red teams.
• No-code/low-code automation platforms are emerging as a primary execution vector, enabling "Shadow Workflows" that mimic traditional code execution.
• Defenders must adapt by focusing on cloud identity governance, OAuth security, SaaS app inventory, and leveraging resources like the SaaS Attack Matrix to build robust defenses.
• Lateral movement in SaaS is characterized by app-to-app or identity-to-identity pivoting, requiring different detection and prevention strategies.

About the Speaker(s)

Luke Jennings is a distinguished security professional currently with Push Security. His career trajectory reflects the evolving nature of cybersecurity threats. He began in red team and offensive security with MWR, where he gained expertise in exploiting vulnerabilities. Subsequently, he transitioned into the detection and response space, contributing to the design of EDR software and developing new threat hunting techniques. This diverse background, spanning both offensive and defensive disciplines, provides him with a comprehensive understanding of the attack lifecycle. Now, at Push Security, a SaaS security company, Jennings is at the forefront of researching and addressing the unique security challenges presented by SaaS environments, making him a highly credible voice on "The New SaaS Cyber Kill Chain."