SQ-OAUTH-01Level 3 · Sequence4 steps in 90 days
Consent to compromise
- 4 steps
- 90 days
- Level 3 · Sequence
A person grants a third-party app risky OAuth permissions, the vendor behind the app is breached, the app's token is used from an unusual context off-hours, and a bulk export follows, all within 90 days.
Classification
- Risk domains One of 9 areas of human risk, from social engineering to readiness and response. Every signal belongs to one.
- Dimensions Every signal answers one of 3 questions.
- Evidence level
- Maturity practices One capability a program performs, scored on its own: See, Understand, Act, Prove, Govern and Culture.
- Leads to The kind of breach the evidence beneath it points toward, each anchored to a Verizon DBIR or VERIS pattern or an FBI IC3 category.
- ATT&CK tactics
-
- Initial Access
- Resource Development
- Persistence
- Exfiltration
- NIST CSF 2.0 (from its signals)
-
- GV.SC-07
- DE.CM-03
- MITRE ATT&CK (from its signals)
-
- T1528
- T1199
- T1078
- T1530
The sequence, step by step
SQ-OAUTH-014 stepsPeak: Stage 4 Suspected
Step 01ATT&CK tactic: Initial Access
Risky consent granted
WC-B-04Grants risky OAuth permissions
Stage 3Exploited
Step 02ATT&CK tactic: Resource Development
Vendor breached
WC-T-02Third-party app they use was breached
Stage 1Exposed
Step 03ATT&CK tactic: Persistence
Token used off-hours
IA-B-04Signs in from unusual contexts
Stage 4Suspected
Step 04ATT&CK tactic: Exfiltration
Bulk export
DH-B-01Downloads data in bulk above own baseline
Stage 4Suspected
Consent to compromise, 4 steps inside 90 days: Risky consent granted (WC-B-04 Grants risky OAuth permissions, Initial Access, Stage 3 Exploited); then Vendor breached (WC-T-02 Third-party app they use was breached, Resource Development, Stage 1 Exposed); then Token used off-hours (IA-B-04 Signs in from unusual contexts, Persistence, Stage 4 Suspected); then Bulk export (DH-B-01 Downloads data in bulk above own baseline, Exfiltration, Stage 4 Suspected). It leads to HB-08 Third-party, OAuth & supply chain.
A completed sequence is evidence that its steps happened in order inside 90 days: a suspicion to triage, with the outcome still open. Here the person reaches Stage 4 Suspected; Stage 5 Confirmed follows only when the SOC opens an incident.
The definition, in detail
Definition
The consent places the person at Stage 3, the breach marks the exposure at Stage 1, and the off-hours token use completes the sequence at Stage 4.
Example
A sales manager connected a free email-tracking add-on in March; the add-on's vendor disclosed a breach in May, and in June the token read the whole mailbox at 03:00 and exported the contact list.
The steps
4 steps, in order.
-
Risky consent granted
-
Vendor breached
-
Token used off-hours
How it is measured
- Steps
- 4
- Window
- 90 days
- Sources
- Web, CASB & DLP, Identity provider & MFA
- Breach scenario
- Third-party, OAuth & supply chain
How it is used
Programs watch the 4 steps in order inside 90 days; a completed run moves the person to Stage 4 Suspected and points at Third-party, OAuth & supply chain.
A completed path is evidence that the steps happened in order inside the window: a suspicion to triage, with the outcome still open. A vigilant behavior at any step breaks the path.
Continue exploring
"Consent to compromise" (SQ-OAUTH-01), Human Risk Management Framework v2.0.0, Living Security, CC BY 4.0. https://www.humanriskmanagement.com/taxonomy/sequences/sq-oauth-01-consent-to-compromise
Part of the open HRM Taxonomy, CC BY 4.0. Download the taxonomy as JSON · What's new in 2.0. This page describes one sequence.
The initial assessment
Find your level.Then fix what matters.
18 questions, about 4 minutes and nothing to type before the result: your level, a score for each practice and three first playbooks, each Easy, Medium or Hard.