1. Home
  2. Matrices
  3. Enterprise
  4. Cloud

Cloud Matrix

Below are the tactics and techniques representing the MITRE ATT&CK® cloud platforms. The Matrix contains information for the following platforms: Office Suite, Identity Provider, SaaS, IaaS.

View on the ATT&CK® Navigator
Initial Access Execution Persistence Privilege Escalation Stealth Defense Impairment Credential Access Discovery Lateral Movement Collection Exfiltration Impact
6 techniques 8 techniques 8 techniques 5 techniques 7 techniques 6 techniques 12 techniques 15 techniques 5 techniques 5 techniques 4 techniques 11 techniques
Drive-by Compromise
Exploit Public-Facing Application
Phishing (2)
=
Supply Chain Compromise
Trusted Relationship
Valid Accounts (2)
=
Cloud Administration Command
Command and Scripting Interpreter (1)
=
Direct Prompt Injection
Indirect Prompt Injection
Poisoned Pipeline Execution
Serverless Execution
Software Deployment Tools
User Execution (1)
=
Account Manipulation (5)
=
Cloud Application Integration
Create Account (1)
=
Event Triggered Execution
Implant Internal Image
Modify Authentication Process (3)
=
Office Application Startup (6)
=
Valid Accounts (2)
=
Abuse Elevation Control Mechanism (1)
=
Account Manipulation (5)
=
Domain or Tenant Policy Modification (1)
=
Event Triggered Execution
Valid Accounts (2)
=
Anti-Automation Evasion (2)
=
Exploitation for Stealth
Hide Artifacts (1)
=
Indicator Removal (1)
=
Social Engineering (2)
=
Unused/Unsupported Cloud Regions
Valid Accounts (2)
=
Disable or Modify Tools (2)
=
Domain or Tenant Policy Modification (1)
=
Exploitation for Defense Impairment
Modify Authentication Process (3)
=
Modify Cloud Compute Infrastructure (5)
=
Modify Cloud Resource Hierarchy
Brute Force (4)
=
Credentials from Password Stores (1)
=
Exploitation for Credential Access
Forge Web Credentials (2)
=
Modify Authentication Process (3)
=
Multi-Factor Authentication Request Generation
Network Sniffing
Steal Application Access Token
Steal Application Specific Passwords
Steal or Forge Authentication Certificates
Steal Web Session Cookie
Unsecured Credentials (3)
=
Account Discovery (2)
=
Cloud Infrastructure Discovery
Cloud Service Dashboard
Cloud Service Discovery
Cloud Storage Object Discovery
Local Storage Discovery
Log Enumeration
Network Service Discovery
Network Sniffing
Password Policy Discovery
Permission Groups Discovery (1)
=
Software Discovery (1)
=
System Information Discovery
System Location Discovery
System Network Connections Discovery
Internal Spearphishing
Remote Services (2)
=
Software Deployment Tools
Taint Shared Content
Use Alternate Authentication Material (2)
=
Automated Collection
Data from Cloud Storage
Data from Information Repositories (6)
=
Data Staged (1)
=
Email Collection (2)
=
AI-Enabled Exfiltration
Exfiltration Over Alternative Protocol
Exfiltration Over Web Service (1)
=
Transfer Data to Cloud Account
Account Access Removal
Data Destruction (1)
=
Data Encrypted for Impact
Defacement (1)
=
Email Bombing
Endpoint Denial of Service (3)
=
Financial Theft
Inhibit System Recovery
Network Denial of Service (2)
=
Resource Hijacking (4)
=
Service Stop
Initial Access Execution Persistence Privilege Escalation Stealth Defense Impairment Credential Access Discovery Lateral Movement Collection Exfiltration Impact
6 techniques 8 techniques 8 techniques 5 techniques 7 techniques 6 techniques 12 techniques 15 techniques 5 techniques 5 techniques 4 techniques 11 techniques
Drive-by Compromise
Exploit Public-Facing Application
=
Phishing (2)
Supply Chain Compromise
Trusted Relationship
=
Valid Accounts (2)
Cloud Administration Command
=
Command and Scripting Interpreter (1)
Direct Prompt Injection
Indirect Prompt Injection
Poisoned Pipeline Execution
Serverless Execution
Software Deployment Tools
=
User Execution (1)
=
Account Manipulation (5)
Cloud Application Integration
=
Create Account (1)
Event Triggered Execution
Implant Internal Image
=
Modify Authentication Process (3)
=
Office Application Startup (6)
=
Valid Accounts (2)
=
Abuse Elevation Control Mechanism (1)
=
Account Manipulation (5)
=
Domain or Tenant Policy Modification (1)
Event Triggered Execution
=
Valid Accounts (2)
=
Anti-Automation Evasion (2)
Exploitation for Stealth
=
Hide Artifacts (1)
=
Indicator Removal (1)
=
Social Engineering (2)
Unused/Unsupported Cloud Regions
=
Valid Accounts (2)
=
Disable or Modify Tools (2)
=
Domain or Tenant Policy Modification (1)
Exploitation for Defense Impairment
=
Modify Authentication Process (3)
=
Modify Cloud Compute Infrastructure (5)
Modify Cloud Resource Hierarchy
=
Brute Force (4)
=
Credentials from Password Stores (1)
Exploitation for Credential Access
=
Forge Web Credentials (2)
=
Modify Authentication Process (3)
Multi-Factor Authentication Request Generation
Network Sniffing
Steal Application Access Token
Steal Application Specific Passwords
Steal or Forge Authentication Certificates
Steal Web Session Cookie
=
Unsecured Credentials (3)
=
Account Discovery (2)
Cloud Infrastructure Discovery
Cloud Service Dashboard
Cloud Service Discovery
Cloud Storage Object Discovery
Local Storage Discovery
Log Enumeration
Network Service Discovery
Network Sniffing
Password Policy Discovery
=
Permission Groups Discovery (1)
=
Software Discovery (1)
System Information Discovery
System Location Discovery
System Network Connections Discovery
Internal Spearphishing
=
Remote Services (2)
Software Deployment Tools
Taint Shared Content
=
Use Alternate Authentication Material (2)
Automated Collection
Data from Cloud Storage
=
Data from Information Repositories (6)
=
Data Staged (1)
=
Email Collection (2)
AI-Enabled Exfiltration
Exfiltration Over Alternative Protocol
=
Exfiltration Over Web Service (1)
Transfer Data to Cloud Account
Account Access Removal
=
Data Destruction (1)
Data Encrypted for Impact
=
Defacement (1)
Email Bombing
=
Endpoint Denial of Service (3)
Financial Theft
Inhibit System Recovery
=
Network Denial of Service (2)
=
Resource Hijacking (4)
Service Stop