Source: Microsoft Security Blog
Author: Microsoft Security Research and Lior Leizerovich
URL: https://www.microsoft.com/en-us/security/blog/2026/09/09/threat-matrix-mapping-threats-across-cloud-web-applications/
Threat matrix: Mapping threats across cloud web applications
ONE SENTENCE SUMMARY:
Microsoft’s MITRE ATT&CK-aligned cloud web applications threat matrix maps techniques across app and cloud layers to prioritize defenses.
MAIN POINTS:
- Attack paths span code, runtimes, identities, pipelines, and connected cloud resources.
- Separate app-versus-cloud investigations create blind spots and missed adversary chaining opportunities.
- Matrix organizes cloud web app and serverless techniques by MITRE ATT&CK tactics.
- Subdomain takeover can occur from orphaned DNS pointing at reusable provider endpoints.
- Initial access includes app vulnerabilities, repo injections, compromised images, misconfigured admin interfaces, trigger abuse.
- Execution vectors include remote code execution exploits, cloud-native terminals, and malicious App Service extensions.
- Persistence occurs via scheduled jobs, source modification in canonical artifacts, and compromised valid accounts.
- Privilege escalation leverages app-stored secrets or workload identity tokens via metadata/identity endpoints.
- Defense evasion uses staging slots/aliases and disabling or manipulating cloud logging controls.
- Impact techniques include theft, destruction, defacement, resource hijacking, and denial-of-wallet cost abuse.
TAKEAWAYS:
- Prioritize MFA and least privilege for users, workloads, and deployment access paths.
- Lock down repositories, build systems, registries, and extensions to trusted sources only.
- Eliminate reusable secrets in code/config by using workload identities and proper secrets management.
- Centralize protected logging and prevent tampering to enable detection and incident reconstruction.
- Reduce blast radius with quotas, concurrency limits, cost guardrails, and tested backup recovery.