diff --git a/cloud_resources/attack_saas.svg b/cloud_resources/attack_saas.svg deleted file mode 100644 index 20cd38d..0000000 --- a/cloud_resources/attack_saas.svg +++ /dev/null @@ -1,2 +0,0 @@ - -aboutOmar's SaaSMITREATT&CK TTPs for SaaS implementationsdomainEnterprise ATT&CK v15platformsSaaS, Office 365, Google WorkspaceDrive-byCompromisePhishingTrustedRelationshipValidAccountsSpearphishingLinkSpearphishingVoiceCloudAccountsDefaultAccountsInitialAccessCommandand ScriptingInterpreterServerlessExecutionSoftwareDeploymentToolsCloudAPIExecutionAccountManipulationCreateAccountEvent TriggeredExecutionModifyAuthenticationProcessOfficeApplicationStartupValidAccountsAdditionalCloudCredentialsAdditionalCloud RolesAdditionalEmail DelegatePermissionsDeviceRegistrationCloudAccountConditionalAccessPoliciesHybridIdentityMulti-FactorAuthenticationAdd-insOfficeTemplateMacrosOfficeTestOutlookFormsOutlookHome PageOutlookRulesCloudAccountsDefaultAccountsPersistenceAbuse ElevationControlMechanismAccountManipulationDomain orTenant PolicyModificationEvent TriggeredExecutionValidAccountsTemporaryElevatedCloud AccessAdditionalCloudCredentialsAdditionalCloud RolesAdditionalEmail DelegatePermissionsDeviceRegistrationTrustModificationCloudAccountsDefaultAccountsPrivilegeEscalationAbuse ElevationControlMechanismDomain orTenant PolicyModificationExploitationforDefense EvasionHideArtifactsImpairDefensesImpersonationIndicatorRemovalModifyAuthenticationProcessUse AlternateAuthenticationMaterialValidAccountsTemporaryElevatedCloud AccessTrustModificationEmailHiding RulesDisableor ModifyCloud LogsClearMailbox DataConditionalAccessPoliciesHybridIdentityMulti-FactorAuthenticationApplicationAccess TokenWeb SessionCookieCloudAccountsDefaultAccountsDefenseEvasionBruteForceForge WebCredentialsModifyAuthenticationProcessMulti-FactorAuthenticationRequest GenerationStealApplicationAccess TokenSteal WebSession CookieUnsecuredCredentialsCredentialStuffingPasswordCrackingPasswordGuessingPasswordSprayingSAMLTokensWebCookiesConditionalAccessPoliciesHybridIdentityMulti-FactorAuthenticationChatMessagesCredentialAccessAccountDiscoveryCloud ServiceDashboardCloud ServiceDiscoveryPermissionGroupsDiscoveryCloudAccountEmailAccountCloudGroupsDiscoveryInternalSpearphishingSoftwareDeploymentToolsTaint SharedContentUse AlternateAuthenticationMaterialApplicationAccess TokenWeb SessionCookieLateralMovementAutomatedCollectionData fromCloud StorageData fromInformationRepositoriesEmailCollectionCodeRepositoriesConfluenceSharepointEmailForwardingRuleRemote EmailCollectionCollectionExfiltrationOver AlternativeProtocolExfiltrationOverWeb ServiceTransferData toCloud AccountExfiltrationOver WebhookExfiltrationAccountAccess RemovalEndpoint Denialof ServiceFinancialTheftNetwork Denialof ServiceApplicationExhaustionFloodApplicationor SystemExploitationServiceExhaustionFloodDirectNetworkFloodReflectionAmplificationImpact