According to Crowd Strike Global Threat Report 2025, 75% of the incurs in 2024 used valid accounting data, and IBM X-Force records an increase in credential-based attacks by 71% year-year. Earlier in the morning - in SIEM falls an alterth: the service account of the SaaS platform, inactive for three months, begins to massively subtract client entries through the API. The token is valid, GeoIP is an office hook. The employee who owned the account resigned last quarter.
Familiarly? This is a compromising SaaS platform through Valid Accounts (T1078, Initial Access) Most SOC teams miss it because they don’t build a baseline for cloud-legs. Albert looks like legitimate activity until you start digging.
Shared Responsibility Model: where SOC loses visibility in SaaS
The Shared responsibility model cloud separates the area of responsibility simply: the SaaS provider closes the infrastructure (individual data centers, network, basic code, patchage of server components), the client - configuration, access control, data protection in SaaS and monitoring user activity.
In practice, for SOC, these are blind spots. The provider gives the audit log level of the application: who logged, what file opened, which API-endpoint caused. But you can't see:
• network traffic between microservices within the provider platform
• configuration of tenant isolation multitenancy at the infrastructure level (how exactly the data is shared between tenants - and this is a million question)
• Vulnerabilities and SDK Service Stack
OWASP Top 10 confirms: Security Misconfiguration (A05:2021) One of the most common causes of cloud application security incidents, and Broken Access Control (A01:2021) It is found in 94% of the tested applications. SOC at the same time sees only what the provider decided to log. NIST CSF 2.0 in the DE.AE-01 category requires building a baseline network operations and expected data streams - for the SaaS environment, this means: before catching anomalies, you need to understand how the normal operation of each application in the stack looks.
Specific numbers: Google Workspace audit log contains about 50 types of events, Microsoft 365 - more than 100, Salesforce - depends on the license. If the SOC has not inventoryed which events and fields are available for each SaaS application, the detection is built on incomplete data. And this is not a theory - it's what I see in every second project.
SaaS Platform Compromise Vectors: TTPs Attackers
Credential-based attack: stuffing to MFA audit
According to Verizon DBIR 2025, 38% of data breaches are related to account data theft. The number of cloud incidents increased by 26% year-on-year (CrowdStrike). In the SaaS-context of the credential-based attack - the main vector of initial access, and here nothing has changed for the third year in a row.
Credential Stuffing (T11100.004, Credential Access) - automated overburden of pairs login/password from leaked bases. The attacker drives the base against public login-enditions (login.microsoftonline.com, SSO-portal of the organization). Coincided - access to the tenant with the rights of the victim.
Cloud Accounts (T1078.004, Initial Access / Persistence) - use of compromised cloud accounting. Stove SSO-token through phishing or infostealer - the attacker gets access to all SaaS applications integrated with IdP, without knowing the password to everyone. CrowdStrike captures: GenaI’s malware use for phishing doubled in 2024. IBM X-Force adds that Geneai phishing email generation is 11.4 times faster at comparable quality. The threshold of entry for the attacker falls.
MFA Rety - MFA Request GenerationT1621, Credential Access) An attacking, knowing password, bombards the victim with push notifications. At 2-3 o'clock in the morning, the user presses "Approve" to stop the flow. Through this vector, accounts were compromised in a number of public incidents with SaaS platforms. Bypass MFA (T1556.006, Defense Impass / Credential Access) - separate category: OTP interception, disparaging IdP, abuse of recovery-procedures.
Three detection signals to be caught: an anomalous number of unsuccessful logins with one IP (stuffing), a successful login from the new GeoIP after the failed series of attempts (account gainover), multiple MFA-queries in a short period (fatigue). Each requires the calibration of thresholds for a specific organization - default values from the documentation of the SIEM-vendor do not work here.
SaaS misconfiguration and data breach in the cloud
According to BetterCloud (2025), 56% of IT commands record cases of external oversharing data, and 53% call publicly shared files with sensitive information the main problem.
Typical SaaS misconfiguration risks are things that occur on each audit: a file in SharePoint/Google Drive with the setup "anyone with the link", API-key service account with excess rights, S3-backet with public access. Each of these cases gives the attacker the path to data through Data from Cloud Storage (T1530, Collection) - without exploiting vulnerabilities. Why break when the door is open?
For multitenant SaaS platforms misconfiguration at the level of tenant isolation - a separate history. If the insulation between tenants is implemented at the application level (row-level security in the database, filtering by tenant_id in API), and not at the infrastructure level - an error in one API-endpoint can give IDOR between tents. On SaaS-platform IDB through tenant_id in path/query parameters - one of the first checks. In Burp Suite, this is checked by a stranger's substrate tenant_id in an authorized request: if the data of another tenant comes in the response - the isolation is broken, Broken Access Control (A01:2021) in its pure form.
For SOC, the key detection signal is to contact the user’s access to resources that do not belong to its tenant. If SaaS provider logs tenant_id in audit log - this field must be present in the correlation rules. The GCP Security Command Center and AWS IAM Access Analyzer partially close this gap for the cloud infrastructure, but the SaaS level remains a blind zone without SSPM.
Insider threat and compromised legitimate accounts
BetterCloud (2025 State of SaaS Report): 48% of IT teams are concerned about missing offboarding steps when Employees are fired. Insider threat - malicious insider or compromised legitimate account - stable in the top of SaaS-risks.
The scenario from the introduction is not synthetic. Service accounts, unannounced API tokens of dismissed employees, OAuth third-party grants with excess - objects that accumulate in the SaaS environment and become entry points. A separate pain - shadow IT: SaaS-applications connected by employees without the knowledge of IT. According to BetterCloud, it’s a worrying issue. Every unaccounted application with an OAuth-grant to read the corporate mail read is a potential data leakage channel in the cloud.
Detection insider threatr in SaaS requires behavioral baseline: the volume of file downloads, activity time, typical API-calls for each user. Anomaly is a deviation from a personal or group pattern, not an absolute threshold. Alert "dropped more than 50 files" is useless if the analyst has a normal Monday.
Detection for SaaS environments: baseline, alerates and correlation rules
What to Monitor in Cloud Logs
For a detection-pybele SOC-command need at least four categories of events from each SaaS application:
1. Authentication : Successful and Unsuccessful Logins, MFA-Events, SSO Tokens, Password Changes - Covers T1078, T1110T1110, T1621
2. Authorization and privileges : role changes, add administrators, creation of service accounts, purpose of OAute-grants - Privilege Escalation
3. Data Access: File Download, Report Export, API-Call Calls to Sensitive Endpoints - T1530
4. Configuration : sharing settings change, MFA disconnection, IP-whitelist modification, integration add _ A05:2021
Before the construction of the rules - an inventory of the fields of each SaaS source: user_id, IP, timestamp, action, resource, geo, device_info. Without the standardization of fields, the correlation between several SaaS applications is not possible. I saw the SOC teams that collected the logs from the three SaaS for six months and could not correlate any events - because userId in one, user_email in another and actor.id in the third.
Examples of Correlation Rules
Sigma rule for detecting mass downloading files from SaaS-application (thresults require calibration for a specific organization):
YAML:
title: SaaS Mass File Download - Possible Data Exfiltration
status: experimental
logsource:
product: office365
service: audit
detection:
selection:
Operation: FileDownloaded
condition: selection | count() by UserId > 50
timeframe: 15m
level: high
For impossible travel detection: correlation of events login_success by fields UserId, src_ip, geo_country - two successful logins in less than 30 minutes from countries, the distance between which exceeds 500 km. Most SIEM support this correlation through enrichment GeoIP and timeframes.
Third Critical Finding Case - MFA Relying: More Than 5 Events mfa_challenge c result: denied for one UserId in 10 minutes, followed by mfa_challenge c result: approved. This pattern with high accuracy indicates T1621 (MFA Request Generation, Credential Access). If you do not have such a rule in SIEM - add today, seriously.
Baseline: what is considered the norm
Detection without baseline - a false positive generator. The analyst will drown in the amateurs for the first shift. For SaaS-environments, baseline is built on three axes:
• Custom: typical login time, volume of downloads, set of applications used for each role
• Applications : normal volume of API-chickers, typical integrations, standard sharing settings
• Configuration: fixed security settings (MAA included, sharing limited, admin list approved) - any change generates analt
NIST CSF 2.0 (DE.AE-01) clearly requires a baseline. In practice, its construction takes 2-4 weeks of monitoring the normal functioning of the environment. You can not rush here - too short a window will give a baseline curve, and you will catch phantoms. After construction, each rule of correlation is attached to a specific deviation, and not to the absolute threshold.
SSPM Tools: Trade-off Table for Choice
From the practice of implementation: Obsidian Security and Wing Security give real value to audit OAute-grants and the detection of configuration drift. The control illusion begins when an organization relies on SSPM as a single instrument - without SIEM integration, without a reaction response playbook and without a behavioral baseline. SSPM shows a configuration diff, but does not detect an active real-time attack. These are two different tools for two different tasks, and one another does not replace.
Familiarly? This is a compromising SaaS platform through Valid Accounts (T1078, Initial Access) Most SOC teams miss it because they don’t build a baseline for cloud-legs. Albert looks like legitimate activity until you start digging.
Shared Responsibility Model: where SOC loses visibility in SaaS
The Shared responsibility model cloud separates the area of responsibility simply: the SaaS provider closes the infrastructure (individual data centers, network, basic code, patchage of server components), the client - configuration, access control, data protection in SaaS and monitoring user activity.
In practice, for SOC, these are blind spots. The provider gives the audit log level of the application: who logged, what file opened, which API-endpoint caused. But you can't see:
• network traffic between microservices within the provider platform
• configuration of tenant isolation multitenancy at the infrastructure level (how exactly the data is shared between tenants - and this is a million question)
• Vulnerabilities and SDK Service Stack
OWASP Top 10 confirms: Security Misconfiguration (A05:2021) One of the most common causes of cloud application security incidents, and Broken Access Control (A01:2021) It is found in 94% of the tested applications. SOC at the same time sees only what the provider decided to log. NIST CSF 2.0 in the DE.AE-01 category requires building a baseline network operations and expected data streams - for the SaaS environment, this means: before catching anomalies, you need to understand how the normal operation of each application in the stack looks.
Specific numbers: Google Workspace audit log contains about 50 types of events, Microsoft 365 - more than 100, Salesforce - depends on the license. If the SOC has not inventoryed which events and fields are available for each SaaS application, the detection is built on incomplete data. And this is not a theory - it's what I see in every second project.
SaaS Platform Compromise Vectors: TTPs Attackers
Credential-based attack: stuffing to MFA audit
According to Verizon DBIR 2025, 38% of data breaches are related to account data theft. The number of cloud incidents increased by 26% year-on-year (CrowdStrike). In the SaaS-context of the credential-based attack - the main vector of initial access, and here nothing has changed for the third year in a row.
Credential Stuffing (T11100.004, Credential Access) - automated overburden of pairs login/password from leaked bases. The attacker drives the base against public login-enditions (login.microsoftonline.com, SSO-portal of the organization). Coincided - access to the tenant with the rights of the victim.
Cloud Accounts (T1078.004, Initial Access / Persistence) - use of compromised cloud accounting. Stove SSO-token through phishing or infostealer - the attacker gets access to all SaaS applications integrated with IdP, without knowing the password to everyone. CrowdStrike captures: GenaI’s malware use for phishing doubled in 2024. IBM X-Force adds that Geneai phishing email generation is 11.4 times faster at comparable quality. The threshold of entry for the attacker falls.
MFA Rety - MFA Request GenerationT1621, Credential Access) An attacking, knowing password, bombards the victim with push notifications. At 2-3 o'clock in the morning, the user presses "Approve" to stop the flow. Through this vector, accounts were compromised in a number of public incidents with SaaS platforms. Bypass MFA (T1556.006, Defense Impass / Credential Access) - separate category: OTP interception, disparaging IdP, abuse of recovery-procedures.
Three detection signals to be caught: an anomalous number of unsuccessful logins with one IP (stuffing), a successful login from the new GeoIP after the failed series of attempts (account gainover), multiple MFA-queries in a short period (fatigue). Each requires the calibration of thresholds for a specific organization - default values from the documentation of the SIEM-vendor do not work here.
SaaS misconfiguration and data breach in the cloud
According to BetterCloud (2025), 56% of IT commands record cases of external oversharing data, and 53% call publicly shared files with sensitive information the main problem.
Typical SaaS misconfiguration risks are things that occur on each audit: a file in SharePoint/Google Drive with the setup "anyone with the link", API-key service account with excess rights, S3-backet with public access. Each of these cases gives the attacker the path to data through Data from Cloud Storage (T1530, Collection) - without exploiting vulnerabilities. Why break when the door is open?
For multitenant SaaS platforms misconfiguration at the level of tenant isolation - a separate history. If the insulation between tenants is implemented at the application level (row-level security in the database, filtering by tenant_id in API), and not at the infrastructure level - an error in one API-endpoint can give IDOR between tents. On SaaS-platform IDB through tenant_id in path/query parameters - one of the first checks. In Burp Suite, this is checked by a stranger's substrate tenant_id in an authorized request: if the data of another tenant comes in the response - the isolation is broken, Broken Access Control (A01:2021) in its pure form.
For SOC, the key detection signal is to contact the user’s access to resources that do not belong to its tenant. If SaaS provider logs tenant_id in audit log - this field must be present in the correlation rules. The GCP Security Command Center and AWS IAM Access Analyzer partially close this gap for the cloud infrastructure, but the SaaS level remains a blind zone without SSPM.
Insider threat and compromised legitimate accounts
BetterCloud (2025 State of SaaS Report): 48% of IT teams are concerned about missing offboarding steps when Employees are fired. Insider threat - malicious insider or compromised legitimate account - stable in the top of SaaS-risks.
The scenario from the introduction is not synthetic. Service accounts, unannounced API tokens of dismissed employees, OAuth third-party grants with excess - objects that accumulate in the SaaS environment and become entry points. A separate pain - shadow IT: SaaS-applications connected by employees without the knowledge of IT. According to BetterCloud, it’s a worrying issue. Every unaccounted application with an OAuth-grant to read the corporate mail read is a potential data leakage channel in the cloud.
Detection insider threatr in SaaS requires behavioral baseline: the volume of file downloads, activity time, typical API-calls for each user. Anomaly is a deviation from a personal or group pattern, not an absolute threshold. Alert "dropped more than 50 files" is useless if the analyst has a normal Monday.
Detection for SaaS environments: baseline, alerates and correlation rules
What to Monitor in Cloud Logs
For a detection-pybele SOC-command need at least four categories of events from each SaaS application:
1. Authentication : Successful and Unsuccessful Logins, MFA-Events, SSO Tokens, Password Changes - Covers T1078, T1110T1110, T1621
2. Authorization and privileges : role changes, add administrators, creation of service accounts, purpose of OAute-grants - Privilege Escalation
3. Data Access: File Download, Report Export, API-Call Calls to Sensitive Endpoints - T1530
4. Configuration : sharing settings change, MFA disconnection, IP-whitelist modification, integration add _ A05:2021
Before the construction of the rules - an inventory of the fields of each SaaS source: user_id, IP, timestamp, action, resource, geo, device_info. Without the standardization of fields, the correlation between several SaaS applications is not possible. I saw the SOC teams that collected the logs from the three SaaS for six months and could not correlate any events - because userId in one, user_email in another and actor.id in the third.
Examples of Correlation Rules
Sigma rule for detecting mass downloading files from SaaS-application (thresults require calibration for a specific organization):
YAML:
title: SaaS Mass File Download - Possible Data Exfiltration
status: experimental
logsource:
product: office365
service: audit
detection:
selection:
Operation: FileDownloaded
condition: selection | count() by UserId > 50
timeframe: 15m
level: high
For impossible travel detection: correlation of events login_success by fields UserId, src_ip, geo_country - two successful logins in less than 30 minutes from countries, the distance between which exceeds 500 km. Most SIEM support this correlation through enrichment GeoIP and timeframes.
Third Critical Finding Case - MFA Relying: More Than 5 Events mfa_challenge c result: denied for one UserId in 10 minutes, followed by mfa_challenge c result: approved. This pattern with high accuracy indicates T1621 (MFA Request Generation, Credential Access). If you do not have such a rule in SIEM - add today, seriously.
Baseline: what is considered the norm
Detection without baseline - a false positive generator. The analyst will drown in the amateurs for the first shift. For SaaS-environments, baseline is built on three axes:
• Custom: typical login time, volume of downloads, set of applications used for each role
• Applications : normal volume of API-chickers, typical integrations, standard sharing settings
• Configuration: fixed security settings (MAA included, sharing limited, admin list approved) - any change generates analt
NIST CSF 2.0 (DE.AE-01) clearly requires a baseline. In practice, its construction takes 2-4 weeks of monitoring the normal functioning of the environment. You can not rush here - too short a window will give a baseline curve, and you will catch phantoms. After construction, each rule of correlation is attached to a specific deviation, and not to the absolute threshold.
SSPM Tools: Trade-off Table for Choice
From the practice of implementation: Obsidian Security and Wing Security give real value to audit OAute-grants and the detection of configuration drift. The control illusion begins when an organization relies on SSPM as a single instrument - without SIEM integration, without a reaction response playbook and without a behavioral baseline. SSPM shows a configuration diff, but does not detect an active real-time attack. These are two different tools for two different tasks, and one another does not replace.
