Threat matrix: Mapping threats across cloud web applications

Source: Microsoft Security Blog

Author: Microsoft Security Research and Lior Leizerovich

URL: https://www.microsoft.com/en-us/security/blog/2026/09/09/threat-matrix-mapping-threats-across-cloud-web-applications/

Threat matrix: Mapping threats across cloud web applications

ONE SENTENCE SUMMARY:

Microsoft’s MITRE ATT&CK-aligned cloud web applications threat matrix maps techniques across app and cloud layers to prioritize defenses.

MAIN POINTS:

  1. Attack paths span code, runtimes, identities, pipelines, and connected cloud resources.
  2. Separate app-versus-cloud investigations create blind spots and missed adversary chaining opportunities.
  3. Matrix organizes cloud web app and serverless techniques by MITRE ATT&CK tactics.
  4. Subdomain takeover can occur from orphaned DNS pointing at reusable provider endpoints.
  5. Initial access includes app vulnerabilities, repo injections, compromised images, misconfigured admin interfaces, trigger abuse.
  6. Execution vectors include remote code execution exploits, cloud-native terminals, and malicious App Service extensions.
  7. Persistence occurs via scheduled jobs, source modification in canonical artifacts, and compromised valid accounts.
  8. Privilege escalation leverages app-stored secrets or workload identity tokens via metadata/identity endpoints.
  9. Defense evasion uses staging slots/aliases and disabling or manipulating cloud logging controls.
  10. Impact techniques include theft, destruction, defacement, resource hijacking, and denial-of-wallet cost abuse.

TAKEAWAYS:

  1. Prioritize MFA and least privilege for users, workloads, and deployment access paths.
  2. Lock down repositories, build systems, registries, and extensions to trusted sources only.
  3. Eliminate reusable secrets in code/config by using workload identities and proper secrets management.
  4. Centralize protected logging and prevent tampering to enable detection and incident reconstruction.
  5. Reduce blast radius with quotas, concurrency limits, cost guardrails, and tested backup recovery.