1. Home
  2. Matrices
  3. Cloud

Cloud Matrix

Below are the tactics and techniques representing the MITRE ATT&CK® Matrix for Enterprise covering cloud-based techniques. The Matrix contains information for the following platforms: Azure AD, Office 365, Google Workspace, SaaS, IaaS.

View on the ATT&CK® Navigator
Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Exfiltration Impact
5 techniques 1 techniques 5 techniques 2 techniques 7 techniques 7 techniques 13 techniques 3 techniques 5 techniques 1 techniques 7 techniques
Drive-by Compromise
Exploit Public-Facing Application
Phishing (1)
=
Trusted Relationship
Valid Accounts (2)
=
User Execution (1)
=
Account Manipulation (5)
=
Create Account (1)
=
Implant Internal Image
Office Application Startup (6)
=
Valid Accounts (2)
=
Domain Policy Modification (1)
=
Valid Accounts (2)
=
Domain Policy Modification (1)
=
Hide Artifacts (1)
=
Impair Defenses (3)
=
Modify Cloud Compute Infrastructure (4)
=
Unused/Unsupported Cloud Regions
Use Alternate Authentication Material (2)
=
Valid Accounts (2)
=
Brute Force (4)
=
Forge Web Credentials (2)
=
Multi-Factor Authentication Request Generation
Network Sniffing
Steal Application Access Token
Steal Web Session Cookie
Unsecured Credentials (2)
=
Account Discovery (2)
=
Cloud Infrastructure Discovery
Cloud Service Dashboard
Cloud Service Discovery
Cloud Storage Object Discovery
Network Service Discovery
Network Sniffing
Password Policy Discovery
Permission Groups Discovery (1)
=
Software Discovery (1)
=
System Information Discovery
System Location Discovery
System Network Connections Discovery
Internal Spearphishing
Taint Shared Content
Use Alternate Authentication Material (2)
=
Automated Collection
Data from Cloud Storage Object
Data from Information Repositories (3)
=
Data Staged (1)
=
Email Collection (2)
=
Transfer Data to Cloud Account
Account Access Removal
Data Destruction
Data Encrypted for Impact
Defacement (1)
=
Endpoint Denial of Service (3)
=
Network Denial of Service (2)
=
Resource Hijacking
Last modified: 01 April 2022
Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Exfiltration Impact
5 techniques 1 techniques 5 techniques 2 techniques 7 techniques 7 techniques 13 techniques 3 techniques 5 techniques 1 techniques 7 techniques
Drive-by Compromise
Exploit Public-Facing Application
=
Phishing (1)
Trusted Relationship
=
Valid Accounts (2)
=
User Execution (1)
=
Account Manipulation (5)
=
Create Account (1)
Implant Internal Image
=
Office Application Startup (6)
=
Valid Accounts (2)
=
Domain Policy Modification (1)
=
Valid Accounts (2)
=
Domain Policy Modification (1)
=
Hide Artifacts (1)
=
Impair Defenses (3)
=
Modify Cloud Compute Infrastructure (4)
Unused/Unsupported Cloud Regions
=
Use Alternate Authentication Material (2)
=
Valid Accounts (2)
=
Brute Force (4)
=
Forge Web Credentials (2)
Multi-Factor Authentication Request Generation
Network Sniffing
Steal Application Access Token
Steal Web Session Cookie
=
Unsecured Credentials (2)
=
Account Discovery (2)
Cloud Infrastructure Discovery
Cloud Service Dashboard
Cloud Service Discovery
Cloud Storage Object Discovery
Network Service Discovery
Network Sniffing
Password Policy Discovery
=
Permission Groups Discovery (1)
=
Software Discovery (1)
System Information Discovery
System Location Discovery
System Network Connections Discovery
Internal Spearphishing
Taint Shared Content
=
Use Alternate Authentication Material (2)
Automated Collection
Data from Cloud Storage Object
=
Data from Information Repositories (3)
=
Data Staged (1)
=
Email Collection (2)
Transfer Data to Cloud Account
Account Access Removal
Data Destruction
Data Encrypted for Impact
=
Defacement (1)
=
Endpoint Denial of Service (3)
=
Network Denial of Service (2)
Resource Hijacking
Last modified: 01 April 2022