Technique
Cloud Account Persistence
An umbrella category for methods attackers use to maintain unauthorized access to a victim's cloud accounts (email, SaaS, cloud storage) after an initial account takeover. Rather than simply stealing credentials for one-time access, attackers modify account settings and configurations to ensure they…
Defense
How to defend against this
How to spot it
- After recovering a compromised account
- check for unfamiliar email forwarding rules or inbox rules that redirect
- delete
- or hide messages
- Review connected apps and third-party app permissions in account security settings — revoke any you do not recognize
- Check registered MFA devices and security keys — remove any authenticator apps or phone numbers you did not add
- Verify account recovery options (backup email
- backup phone number) have not been changed to attacker-controlled values
- Review recent account activity or sign-in history for active sessions from unrecognized devices or locations after password reset
- Check for authorized OAuth applications or API tokens with broad access permissions you did not approve
- Monitor for missing expected emails — a gap in correspondence may indicate hidden forwarding or deletion rules
Steps you can take
Further reading
Push Security
Comprehensive overview of SaaS persistence techniques including mail rules, OAuth backdoors, legitimate platform integration abuse, and document-sharing links. Demonstrates how attackers maintain access even after password changes and device wipes.
Microsoft Learn
Microsoft's official incident response guidance for compromised email accounts. Enumerates six remediation steps addressing persistence vectors: disabling the account, revoking sessions, reviewing MFA devices, auditing consented applications, checking roles, and removing mail forwarders.
Proofpoint
Details how attackers register their own MFA devices and authorize OAuth applications (e.g., PERFECTDATA SOFTWARE) after account compromise to maintain persistent access even after credential revocation.
Proofpoint
Research on how attackers create internal OAuth applications with custom scopes and permissions after account compromise. Demonstrates that malicious OAuth apps maintain authorized access even after password resets or MFA enforcement.
Proofpoint
Lifecycle view of account compromise showing persistence as the dominant risk phase. Reports that 88% of organizations experiencing ATO attacks show evidence of post-access persistence activity including MFA manipulation and OAuth abuse.
MITRE ATT&CK
T1098 Account Manipulation framework mapping with sub-techniques for additional cloud credentials (T1098.001), email delegate permissions (T1098.002), and device registration (T1098.005) — the enterprise-focused equivalents of consumer cloud account persistence methods.