Third-Party Supply Chain Attacks: Securing Identity & MSPs

Executive Summary

Modern enterprises rely heavily on third-party SaaS platforms, MSPs, OAuth integrations, and programmatic API keys. Every integration silently extends the enterprise boundary. When an external vendor is compromised, adversaries inherit pre-approved access into customer environments without needing exploits or triggering MFA.

To counter this, threat hunters cannot rely on isolated signature rules. Effective defense requires continuous behavioral baselining of Non-Human Identities (NHIs) across identity, cloud, and data platforms, coupled with proactive anomaly hunting around high-impact Crown Jewels.

The Non-Human Identity (NHI) Dilemma

In cloud environments, Non-Human Identities outnumber human users by 45 to 1. NHIs present five critical structural vulnerabilities:

• No Interactive MFA: Service principals and API keys authenticate programmatically without interactive challenges.
• Excessive & Static Scopes: Integrations frequently retain broad tenant-wide permissions (e.g., Directory.ReadWrite.All) that are rarely pruned.
• Infinite Token Lifespans: Long-lived client secrets and unrotated OAuth refresh tokens persist indefinitely.
• Cross-Tenant Blindness: MSP Delegated Admin Privileges (DAP) mask external actions as native tenant operations.
• Absence of Behavioral Baselines: Static allowlists treat all valid API calls equally, allowing malicious queries using valid tokens to blend into background traffic.
  
  

Cross-Platform NHI Baselining Framework

Hunting across identity supply chains requires establishing a 30-to-90 day behavioral profile across four core pillars: (1) Network & Infrastructure Provenance (ASNs, CIDRs, VPCs, TLS fingerprints), (2) API Footprint & Method Diversity (read vs. administrative calls), (3) Velocity & Volumetric Cadence (query rates, burst dumps), and (4) Resource Scope & Blast Radius (databases, secrets vaults, mailboxes accessed).

Five Attack Vectors in Third-Party Supply Chains

Deconstructing Landmark Third-Party Campaigns

• Okta Support Case Breach (2023): Attackers used stolen service account credentials to access Okta support cases, downloading customer HAR files containing unexpired session tokens to hijack admin sessions without MFA.
• Midnight Blizzard (2023–2024): Compromised a test tenant via password spraying, registered rogue OAuth apps with Mail.ReadWrite permissions, and silently harvested executive emails via Microsoft Graph API.
• Kaseya VSA / REvil (2021): Exploited zero-days in MSP management servers, weaponizing trusted console-agent tunnels to distribute ransomware to 1,500+ customer businesses simultaneously.
• CircleCI Breach (2023): Malware on an engineer's workstation compromised SSO session tokens, giving attackers access to production databases containing customer AWS keys, GitHub tokens, and secrets.

Hands-On Lab Simulations & Native Telemetry Evidence

Lab Simulation 01: Illicit Multi-Tenant OAuth App Registration & High-Privilege Consent Grant

Vector 2 | T1098.005 / T1199: Adversary registers a multi-tenant app and tricks an administrator into granting tenant-wide Mail.ReadWrite and Directory.ReadWrite.All permissions.

Captured Native Audit Log Schema Evidence (Entra ID AuditLogs):

Lab Simulation 02: Cross-Tenant API & Service Principal Credential Abuse

Vector 3 | T1078.004 / T1552.004: Adversary uses stolen vendor client credentials to authenticate non-interactively and exfiltrate executive email messages via Microsoft Graph API.

Captured Native Cloud Sign-In & Service Principal Telemetry:

Why Traditional Controls Fall Short

• CASBs: Monitor user web browsing, blind to external direct cloud API calls.
• EDR: Protects physical endpoints, blind to cloud-to-cloud token exchanges.
• MFA: Protects interactive logins, bypassed by programmatic service credentials.
•  Static Allowlisting: Fails because SaaS vendors share multi-tenant, dynamic cloud IP blocks.

Threat Hunter's Spotlight: Advanced 2-Tier Hunting Methodology

Effective threat hunting combines Tier 1 Multi-Platform Behavioral Drift with Tier 2 Crown Jewel Asset Deviations:

[TIER 1: MULTI-PLATFORM BEHAVIORAL BASELINE DEVIATIONS]

HUNT LEAD 1: NHI Infrastructure & Network Provenance Drift (T1078.004 / T1098)

• Telemetry : Entra ID ServicePrincipalSignInLogs, Okta SystemLog, AWS CloudTrail
• Baseline : 30-day historical ASN, source IP CIDR, and User-Agent per machine identity.
• Logic : Flag non-interactive authentications where the source ASN has never previously associated with the AppId, or maps to VPN/Tor exit nodes and foreign hosting.

HUNT LEAD 2: First-Seen & Rare Administrative API Invocations (T1087 / T1069)

• Telemetry : Microsoft Graph Activity Logs, AWS CloudTrail, GCP Audit Logs
• Baseline : 90-day distinct method invocation profile per Service Account / Role.
• Logic : Identify NHI invoking sensitive administrative API with a prior occurrence: Azure: Directory.ReadWrite.All, RoleManagement.ReadWrite, Mail.ReadWrite. AWS: iam:CreateAccessKey, iam:AttachUserPolicy, sts:AssumeRole, kms:Decrypt.

HUNT LEAD 3: Illicit Multi-Tenant OAuth Consent Grants (T1098.005 / T1550)

• Telemetry : Identity Provider Audit Logs (Entra ID, Google Workspace, Okta)
• Baseline : Authorized third-party OAuth app inventory and verified publisher domains.
• Logic : Isolate grants with high-risk permissions (Mail.ReadWrite, Directory.ReadWrite.All) where the publisher is unverified, newly created (<30 days), or external multi-tenant.

[TIER 2: CROWN JEWEL / HIGH-IMPACT ASSET DEVIATIONS]

HUNT LEAD 4: Tier-0 Secrets Store & Key Vault Access Deviations (T1552 / T1555)

• Telemetry : AWS Secrets Manager, HashiCorp Vault, Azure Key Vault, GCP KMS
• Target : Master API Keys, Database Connection Strings, Signing Certificates.
• Logic : Baseline authorized identities permitted to read secrets (GetSecretValue, Decrypt). Flag non-core service principals accessing master vaults or sequential multi-secret paths.

HUNT LEAD 5: Volumetric Data Extraction from Cloud Warehouses (T1530 / T1567)

• Telemetry : Snowflake ACCESS_HISTORY, BigQuery, AWS S3 Server Access Logs
• Target : Production Data Lakes, Customer PII, Billing Repositories.
• Logic : Profile normal daily read volume and query cadence over 30 days. Hunt for statistical anomalies (>3 sigma in bytes scanned) and bulk export commands ('COPY INTO', 'UNLOAD') targeting sensitive schemas from non-corporate IPs.

HUNT LEAD 6: Identity Root & Delegated Admin Out-of-Bounds Tampering (T1078 / T1484)

• Telemetry : Cloud SIEM, Tenant Admin Audit Logs, Federation STS Logs
• Target : Conditional Access Policies, Global Admin Role, Service Principal Credentials.
• Logic : Filter for DelegatedAdmin or App-Only Service Principals modifying Conditional Access, adding secondary credentials to apps, or creating Global Admins outside change windows.

Strategic Mitigations & CISO Recommendations

• Enforce Admin Consent: Disable user OAuth consent; require security review and verified publisher check.
• Operationalize NHI Baselines: Deploy continuous behavioral monitoring for anomalous ASNs, rare APIs, and velocity spikes.
• Bound Crown Jewel Access: Enforce strict resource-scoped, time-bound JIT policies on secrets vaults and data lakes.
• Transition to GDAP: Replace permanent DAP with Granular Delegated Admin Privileges with least-privilege scoping.
• Continuous Token Protection: Enable Continuous Access Evaluation (CAE) to instantly revoke tokens upon network shifts.

Conclusion: Securing the Extended Boundary

Identity is the perimeter, and third-party integrations are its most vulnerable gates. Trust cannot be an operational assumption—it must be continuously baselined, tightly bounded around Crown Jewels, and rigorously audited.

About the Author