HB-08Level 4 · Breach scenarioDBIR third-party involvement · ATT&CK Trusted Relationship
Third-party, OAuth & supply chain
- Level 4 · Breach scenario
- 18 signals
- 6 risk domains
A breach that arrives through a vendor, a connected SaaS app or an OAuth grant, where the human act is the consent or the integration ownership that gave the third party reach.
Classification
- Fed by risk domains One of 9 areas of human risk, from social engineering to readiness and response. Every signal belongs to one.
- Dimensions Every signal answers one of 3 questions.
- Evidence level
- Anchor
-
- DBIR third-party involvement · ATT&CK Trusted Relationship
- NIST CSF 2.0
-
- GV.SC-07
- PR.AA-05
- MITRE ATT&CK
-
- T1199
- T1528
- T1550.001
-
1
Sequence
End in this breach scenario.
-
3
Cohorts
Predict it.
-
18
Signals
Feed it.
-
6
Risk domains
Where those signals come from.
Sequences that lead here
One sequence ends here.
Each one is a set of signals in order inside a window. Watch it play.
SQ-OAUTH-014 stepsPeak: Stage 4 Suspected
Consent to compromise
Step 01ATT&CK tactic: Initial Access
Risky consent granted
WC-B-04Grants risky OAuth permissions
Stage 3Exploited
Step 02ATT&CK tactic: Resource Development
Vendor breached
WC-T-02Third-party app they use was breached
Stage 1Exposed
Step 03ATT&CK tactic: Persistence
Token used off-hours
IA-B-04Signs in from unusual contexts
Stage 4Suspected
Step 04ATT&CK tactic: Exfiltration
Bulk export
DH-B-01Downloads data in bulk above own baseline
Stage 4Suspected
Consent to compromise, 4 steps inside 90 days: Risky consent granted (WC-B-04 Grants risky OAuth permissions, Initial Access, Stage 3 Exploited); then Vendor breached (WC-T-02 Third-party app they use was breached, Resource Development, Stage 1 Exposed); then Token used off-hours (IA-B-04 Signs in from unusual contexts, Persistence, Stage 4 Suspected); then Bulk export (DH-B-01 Downloads data in bulk above own baseline, Exfiltration, Stage 4 Suspected). It leads to HB-08 Third-party, OAuth & supply chain.
-
SQ-OAUTH-01
Consent to compromise
- Step 1: Risky consent granted (WC-B-04 Grants risky OAuth permissions)
- Step 2: Vendor breached (WC-T-02 Third-party app they use was breached)
- Step 3: Token used off-hours (IA-B-04 Signs in from unusual contexts)
- Step 4: Bulk export (DH-B-01 Downloads data in bulk above own baseline)
- Breach scenario: HB-08 Third-party, OAuth & supply chain
The definition, in detail
Definition
The Verizon DBIR tracks it as third-party involvement across patterns, and MITRE ATT&CK names the route Trusted Relationship (T1199).
Example
A breached email add-on vendor loses its OAuth tokens, and the attacker reads every mailbox that granted the add-on full access.
How it is measured
- Anchor
- DBIR third-party involvement · ATT&CK Trusted Relationship
- SOC signals
- Vendor incidents, OAuth abuse
- Fed by
- 18 signals across 6 risk domains
How it is used
Programs measure toward Third-party, OAuth & supply chain by counting the 18 signals, 3 cohorts and 1 sequence that point to it, and tie them to the incidents the SOC records as vendor incidents, oauth abuse.
A breach scenario names what the evidence beneath it points toward. The organization’s own incidents confirm it; the signals, cohorts and sequences show where it is likely.
Technical mappings
Framework mappings; validate for your use case.
Continue exploring
"Third-party, OAuth & supply chain" (HB-08), Human Risk Management Framework v2.0.0, Living Security, CC BY 4.0. https://www.humanriskmanagement.com/taxonomy/breach-scenarios/hb-08-third-party-oauth-and-supply-chain
Part of the open HRM Taxonomy, CC BY 4.0. Download the taxonomy as JSON · What's new in 2.0. This page describes one breach scenario.
The initial assessment
Find your level.Then fix what matters.
18 questions, about 4 minutes and nothing to type before the result: your level, a score for each practice and three first playbooks, each Easy, Medium or Hard.