See the matrix →

Push Logo

Browser & Identity Attacks Matrix

A collection of attack techniques organised by tactic phase. Inspired by MITRE ATT&CK and adapted for cloud-first environments where attacks need no network access or endpoint compromise — read the launch announcement for the full backstory.

Book a demo
10 phases51 techniques Source: github.com/pushsecurity/browser-identity-attacks-matrix

Reconnaissance

5 techniques

SAT1013DNS reconnaissanceSAT1031SAML enumerationSAT1034Slug tenant enumerationSAT1035Subdomain tenant discoverySAT1038Username enumeration

Initial Access

24 techniques

SAT1002Account ambushingSAT1007App sprayingSAT1010Consent phishingSAT1011Credential stuffingSAT1012Device code phishingSAT1015Email phishingSAT1017Ghost loginsSAT1018IM phishingSAT1019IM user spoofingSAT1020In-app phishingSAT1024MFA fatigueSAT1025nOAuthSAT1030Poisoned tenantsSAT1032SAMLjackingSAT1040Hijack OAuth flowsSAT1042AiTM PhishingSAT1043Device EnrollmentSAT1045MFA downgradeSAT1046Guest Access AbuseSAT1047Cross-IdP ImpersonationSAT1048Verification phishingSAT1049UI redressingSAT1050App-specific password phishingSAT1051ConsentFix

Execution

4 techniques

SAT1008Automation workflow sharingSAT1009Client-side app spoofingSAT1027OAuth tokensSAT1033Shadow workflows

Persistence

12 techniques

SAT1004API keysSAT1009Client-side app spoofingSAT1016Evil twin integrationsSAT1017Ghost loginsSAT1022Link sharingSAT1023Malicious mail rulesSAT1027OAuth tokensSAT1036System integrationsSAT1041Inbound federationSAT1043Device EnrollmentSAT1047Cross-IdP ImpersonationSAT1050App-specific password phishing

Privilege Escalation

3 techniques

SAT1001Abuse existing OAuth integrationsSAT1021Link backdooringSAT1023Malicious mail rules

Defense Evasion

11 techniques

SAT1004API keysSAT1009Client-side app spoofingSAT1012Device code phishingSAT1016Evil twin integrationsSAT1017Ghost loginsSAT1022Link sharingSAT1023Malicious mail rulesSAT1036System integrationsSAT1039WebhooksSAT1044Session cookie theftSAT1051ConsentFix

Credential Access

2 techniques

SAT1005API secret theftSAT1028Password scraping

Discovery

3 techniques

SAT1006App directory lookupSAT1014Email discoverySAT1026OAuth token enumeration

Lateral Movement

11 techniques

SAT1001Abuse existing OAuth integrationsSAT1003Account recoverySAT1005API secret theftSAT1008Automation workflow sharingSAT1019IM user spoofingSAT1020In-app phishingSAT1021Link backdooringSAT1029Passwordless loginsSAT1032SAMLjackingSAT1041Inbound federationSAT1044Session cookie theft

Exfiltration

3 techniques

SAT1033Shadow workflowsSAT1037Takeout servicesSAT1039Webhooks