SaaS->Endpoint attacks

[jacques-]

Consider attacks like:

• backdooring github repos so they execute code when opened in vscode - something like https://github.blog/2023-07-18-security-alert-social-engineering-campaign-targets-technology-industry-employees/
• Setting scripts to run on exploits when you breach a SaaS MDM solution

Feels like these would be "Execution" phase attack techniques?

Are there any other we're aware of?

[jukelennings]

Microsoft Power Automate has "Desktop Flows", which is the bit I haven't explored yet, but is a form of Robotic Process Automation (RPA). I'm guessing a user probably needs some software installed for it already, but I'm wondering if someone already makes use of it and you compromise the Power Automate account, then possibly you could modify or create new flows that may allow an endpoint compromise? One to check out for sure.

[jacques-]

Interesting, yeah I wonder how many other thick clients store config in a cloud service that could be used in this way...