attack-path / energy & utilities / oauth-token-phish

OAuth token phishing

Engine-driven compliance rail for OAuth consent-phish → long-lived token replay against SaaS tenant on the Energy & Utilities protect-surface layout. Step controls cycle through the engine's Trust-Failure chain; each step shows the in-scope provisions the failure implicates and, where a regulatory clock applies, the obligation diamond.

advisoryCISA · Joint Cybersecurity Advisory AA24-057A — SVR Cyber Actors Adapt Tactics for Initial Cloud Access (AA24-057A)

resolved atEnergy & Utilities · OT cell (Purdue Model) · Remote user opens a SaaS application

step 01TF1speculativeATT&CK T1566.002

stage 1

Adversary delivers a phishing link prompting OAuth consent for an attacker-controlled application against the victim's SaaS tenant. (Phishing surface itself is not directly observed in AA24-057A; the advisory observes the downstream token-use phase.)

mitigating controls

ztna-gateway

in-scope provisions (6)

partialCIP-013-2 R1 — Supply chain cyber security risk management plannerc-cipdisc:highpendingEvidence
partialID.AM-01 — Asset Managementnist-csf-2-0disc:highpendingEvidence
partialID.AM-02 — Asset Managementnist-csf-2-0disc:highpendingEvidence
partialID.AM-03 — Asset Managementnist-csf-2-0disc:highpendingEvidence
partialID.AM-04 — Asset Managementnist-csf-2-0disc:highpendingEvidence
partialID.AM-05 — Asset Managementnist-csf-2-0disc:highpendingEvidence

obligation

no regulatory clock for this step

protect-surface storyline (DAAS cards)

01
Initial Access
email-svc
A spear-phishing email bypasses email security filters using a typosquatted sender domain. The user receives what appears to be an internal HR notification.
02
Execution
google-workspace
User clicks the embedded link in Gmail. OAuth consent screen prompts grant of "read mail" scope to a malicious third-party app posing as a benefits portal.
03
Persistence
laptops
Drive-by download installs an info-stealer on the user’s laptop. EDR rules are evaded via process-hollowing of a legitimate browser binary.
04
Lateral Movement
crm
Stolen session cookie is replayed against Salesforce. MFA is bypassed because the session token already proved possession. API exports begin.
05
Exfiltration
customer-pii
Customer PII (names, emails, partial card data) is exfiltrated via Salesforce’s Data Loader API in 50k-row chunks to a C2 bucket. Game over.

Compliance rail (text fallback)

Step 1 — TF1 (stage 1) · ATT&CK T1566.002 · evidence: speculative

Adversary delivers a phishing link prompting OAuth consent for an attacker-controlled application against the victim's SaaS tenant. (Phishing surface itself is not directly observed in AA24-057A; the advisory observes the downstream token-use phase.)
- Mitigating controls: ztna-gateway
- Provisions in scope: nerc-cip#CIP-013-2-R1 (partial, disc:high, pendingEvidence); nist-csf-2-0#ID.AM-01 (partial, disc:high, pendingEvidence); nist-csf-2-0#ID.AM-02 (partial, disc:high, pendingEvidence); nist-csf-2-0#ID.AM-03 (partial, disc:high, pendingEvidence); nist-csf-2-0#ID.AM-04 (partial, disc:high, pendingEvidence); nist-csf-2-0#ID.AM-05 (partial, disc:high, pendingEvidence)
Step 2 — TF2 (stage 2) · ATT&CK T1528 · evidence: observed

User consents; attacker application receives a long-lived OAuth access / refresh token. AA24-057A: "SVR actors using tokens to access their victims' accounts, without needing a password" (T1528 — Steal Application Access Token).
- Mitigating controls: idp, mfa-authenticator, ca-pki, kms-secrets, pam
- Provisions in scope: cisa-cpgs-v2#3.A (partial, disc:high, pendingEvidence); cisa-cpgs-v2#3.B (partial, disc:high, pendingEvidence); cisa-cpgs-v2#3.F (partial, disc:high, pendingEvidence); cisa-cpgs-v2#3.G (partial, disc:high, pendingEvidence); nist-csf-2-0#PR.AA-01 (partial, disc:high, pendingEvidence); nist-csf-2-0#PR.AA-02 (partial, disc:high, pendingEvidence)
Step 3 — TF3 (stage 3) · evidence: reported

No application-posture check (publisher verification, permission-scope review) is consumed by the PE; the over-permissioned OAuth grant is accepted. AA24-057A advocates "system and service accounts should implement the principle of least privilege, providing tightly scoped access" — the symmetric mitigation for OAuth scopes.
- Mitigating controls: idp, edr-xdr, mdm-uem, cdm
- Provisions in scope: circia#226.4 (partial, disc:high, pendingEvidence); cisa-cpgs-v2#2.B (partial, disc:high, pendingEvidence); nerc-cip#CIP-003-9-R2 (partial, disc:high, pendingEvidence); nerc-cip#CIP-013-2-R1 (partial, disc:high, pendingEvidence); nist-csf-2-0#PR.AA-01 (partial, disc:high, pendingEvidence); nist-csf-2-0#PR.AA-02 (partial, disc:high, pendingEvidence)
Step 4 — TF5 (stage 5) · evidence: reported

PE grants the token long-lived validity by platform default. AA24-057A mitigation: "Session lifetimes should be kept as short as practical to reduce the window of opportunity for an adversary to use stolen session tokens." Without that tightening, the attacker has a multi-hour or multi-day persistence window.
- Mitigating controls: idp, siem-soar, pam, iga
- Provisions in scope: cisa-cpgs-v2#3.F (partial, disc:high, pendingEvidence); cisa-cpgs-v2#3.G (partial, disc:high, pendingEvidence); nist-csf-2-0#PR.AA-01 (partial, disc:high, pendingEvidence); nist-csf-2-0#PR.AA-02 (partial, disc:high, pendingEvidence); nist-csf-2-0#PR.AA-03 (partial, disc:high, pendingEvidence); nist-csf-2-0#PR.AA-04 (partial, disc:high, pendingEvidence)
Step 5 — TF6 (stage 6) · ATT&CK T1090.002 · evidence: observed

Adversary fetches SaaS resources via residential proxies to defeat IP-based PEP egress checks. AA24-057A documents this residential-proxy pattern as a recurring SVR technique against cloud tenants.
- Mitigating controls: ztna-gateway, dlp, siem-soar, ca-pki, kms-secrets, pam
- Provisions in scope: circia#226.4 (partial, disc:high, pendingEvidence); cisa-cpgs-v2#3.I (partial, disc:high, pendingEvidence); nerc-cip#CIP-003-9-R2 (partial, disc:high, pendingEvidence); nist-csf-2-0#PR.AA-01 (partial, disc:high, pendingEvidence); nist-csf-2-0#PR.AA-02 (partial, disc:high, pendingEvidence); nist-csf-2-0#PR.AA-03 (partial, disc:high, pendingEvidence)
Step 6 — TF8 (stage 8) · evidence: reported

SaaS audit logs do not correlate the OAuth grant timestamp with subsequent unusual scope-of-access patterns. AA24-057A mitigation explicitly recommends "application events and host-based logs" plus "user agent strings" — the absence of which delays detection.
- Mitigating controls: edr-xdr, dlp, siem-soar, pam, iga, cdm
- Provisions in scope: circia#226.11 (partial, disc:high, pendingEvidence); circia#226.4 (partial, disc:high, pendingEvidence); circia#226.5 (partial, disc:high, pendingEvidence); cisa-cpgs-v2#3.O (partial, disc:high, pendingEvidence); cisa-cpgs-v2#3.Q (partial, disc:high, pendingEvidence); nerc-cip#CIP-008-6-R1 (partial, disc:high, pendingEvidence)