Techniques › T1021.007 › AN0020
AN0020 Analytic 0020
SaaS · attack.mitre.org · ATT&CK Enterprise v19.2
<p>Remote access to third-party SaaS with OAuth or API tokens post-initial compromise, followed by sensitive data access or configuration changes</p>
- Detects
- T1021.007 Cloud Services
- Part of
- DET0008 Behavioral Detection of Remote Cloud Logins via Valid Accounts
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| saas:auth | LoginSuccess, APIKeyUse, AdminAction | DC0067 Logon Session Creation |
Mutable elements
Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.
| Field | Description |
|---|---|
OAuthTokenAge | Older tokens issued before password change may indicate compromise |
AppScope | Restrict detection to high-value or regulated SaaS apps |