1. Home
  2. Matrices
  3. Enterprise
  4. Cloud

Cloud Matrix

Below are the tactics and techniques representing the MITRE ATT&CK® cloud platforms. The Matrix contains information for the following platforms: Office Suite, Identity Provider, SaaS, IaaS.

View on the ATT&CK® Navigator
Version Permalink
Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Exfiltration Impact
5 techniques 5 techniques 7 techniques 5 techniques 13 techniques 11 techniques 14 techniques 5 techniques 5 techniques 3 techniques 9 techniques
Drive-by Compromise
Exploit Public-Facing Application
Phishing (2)
=
Trusted Relationship
Valid Accounts (2)
=
Cloud Administration Command
Command and Scripting Interpreter (1)
=
Serverless Execution
Software Deployment Tools
User Execution (1)
=
Account Manipulation (5)
=
Create Account (1)
=
Event Triggered Execution
Implant Internal Image
Modify Authentication Process (3)
=
Office Application Startup (6)
=
Valid Accounts (2)
=
Abuse Elevation Control Mechanism (1)
=
Account Manipulation (5)
=
Domain or Tenant Policy Modification (1)
=
Event Triggered Execution
Valid Accounts (2)
=
Abuse Elevation Control Mechanism (1)
=
Domain or Tenant Policy Modification (1)
=
Exploitation for Defense Evasion
Hide Artifacts (1)
=
Impair Defenses (3)
=
Impersonation
Indicator Removal (1)
=
Modify Authentication Process (3)
=
Modify Cloud Compute Infrastructure (5)
=
Modify Cloud Resource Hierarchy
Unused/Unsupported Cloud Regions
Use Alternate Authentication Material (2)
=
Valid Accounts (2)
=
Brute Force (4)
=
Credentials from Password Stores (1)
=
Exploitation for Credential Access
Forge Web Credentials (2)
=
Modify Authentication Process (3)
=
Multi-Factor Authentication Request Generation
Network Sniffing
Steal Application Access Token
Steal or Forge Authentication Certificates
Steal Web Session Cookie
Unsecured Credentials (3)
=
Account Discovery (2)
=
Cloud Infrastructure Discovery
Cloud Service Dashboard
Cloud Service Discovery
Cloud Storage Object Discovery
Log Enumeration
Network Service Discovery
Network Sniffing
Password Policy Discovery
Permission Groups Discovery (1)
=
Software Discovery (1)
=
System Information Discovery
System Location Discovery
System Network Connections Discovery
Internal Spearphishing
Remote Services (2)
=
Software Deployment Tools
Taint Shared Content
Use Alternate Authentication Material (2)
=
Automated Collection
Data from Cloud Storage
Data from Information Repositories (5)
=
Data Staged (1)
=
Email Collection (2)
=
Exfiltration Over Alternative Protocol
Exfiltration Over Web Service (1)
=
Transfer Data to Cloud Account
Account Access Removal
Data Destruction (1)
=
Data Encrypted for Impact
Defacement (1)
=
Endpoint Denial of Service (3)
=
Financial Theft
Inhibit System Recovery
Network Denial of Service (2)
=
Resource Hijacking (4)
=
Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Exfiltration Impact
5 techniques 5 techniques 7 techniques 5 techniques 13 techniques 11 techniques 14 techniques 5 techniques 5 techniques 3 techniques 9 techniques
Drive-by Compromise
Exploit Public-Facing Application
=
Phishing (2)
Trusted Relationship
=
Valid Accounts (2)
Cloud Administration Command
=
Command and Scripting Interpreter (1)
Serverless Execution
Software Deployment Tools
=
User Execution (1)
=
Account Manipulation (5)
=
Create Account (1)
Event Triggered Execution
Implant Internal Image
=
Modify Authentication Process (3)
=
Office Application Startup (6)
=
Valid Accounts (2)
=
Abuse Elevation Control Mechanism (1)
=
Account Manipulation (5)
=
Domain or Tenant Policy Modification (1)
Event Triggered Execution
=
Valid Accounts (2)
=
Abuse Elevation Control Mechanism (1)
=
Domain or Tenant Policy Modification (1)
Exploitation for Defense Evasion
=
Hide Artifacts (1)
=
Impair Defenses (3)
Impersonation
=
Indicator Removal (1)
=
Modify Authentication Process (3)
=
Modify Cloud Compute Infrastructure (5)
Modify Cloud Resource Hierarchy
Unused/Unsupported Cloud Regions
=
Use Alternate Authentication Material (2)
=
Valid Accounts (2)
=
Brute Force (4)
=
Credentials from Password Stores (1)
Exploitation for Credential Access
=
Forge Web Credentials (2)
=
Modify Authentication Process (3)
Multi-Factor Authentication Request Generation
Network Sniffing
Steal Application Access Token
Steal or Forge Authentication Certificates
Steal Web Session Cookie
=
Unsecured Credentials (3)
=
Account Discovery (2)
Cloud Infrastructure Discovery
Cloud Service Dashboard
Cloud Service Discovery
Cloud Storage Object Discovery
Log Enumeration
Network Service Discovery
Network Sniffing
Password Policy Discovery
=
Permission Groups Discovery (1)
=
Software Discovery (1)
System Information Discovery
System Location Discovery
System Network Connections Discovery
Internal Spearphishing
=
Remote Services (2)
Software Deployment Tools
Taint Shared Content
=
Use Alternate Authentication Material (2)
Automated Collection
Data from Cloud Storage
=
Data from Information Repositories (5)
=
Data Staged (1)
=
Email Collection (2)
Exfiltration Over Alternative Protocol
=
Exfiltration Over Web Service (1)
Transfer Data to Cloud Account
Account Access Removal
=
Data Destruction (1)
Data Encrypted for Impact
=
Defacement (1)
=
Endpoint Denial of Service (3)
Financial Theft
Inhibit System Recovery
=
Network Denial of Service (2)
=
Resource Hijacking (4)
pFad - Phonifier reborn

Pfad - The Proxy pFad of © 2024 Garber Painting. All rights reserved.

Note: This service is not intended for secure transactions such as banking, social media, email, or purchasing. Use at your own risk. We assume no liability whatsoever for broken pages.


Alternative Proxies:

Alternative Proxy

pFad Proxy

pFad v3 Proxy

pFad v4 Proxy