MITRE Map
The catalog as an ATT&CK matrix: one column per tactic, one cell per technique, with the events that produce evidence for it. Click a technique ID for its context page, an event for its detail page, or filter the matrix by provider.
This coverage is also available as ATT&CK Navigator layers, scoring each technique by catalog event count: combined · AWS · Azure · GCP
Provider
T1059 Command and Scripting Interpreter
CreateStack google.ssh-serialport.v1.connect Invoke Microsoft.Automation/automationAccounts/jobs/write Microsoft.Automation/automationAccounts/runbooks/write Microsoft.Automation/automationAccounts/webhooks/action Microsoft.Compute/virtualMachines/extensions/write Microsoft.Compute/virtualMachines/runCommand/action Microsoft.Compute/virtualMachines/write (CustomScriptExtension) Microsoft.ContainerService/managedClusters/runCommand/action Microsoft.SerialConsole/serialPorts/connect/action ModifyInstanceAttribute ResumeSession SendCommand StartBuild StartSession UpdateFunctionCode20150331v2 UpdateFunctionConfiguration20150331v2
T1651 Cloud Administration Command
T1072 Software Deployment Tools
T1053 Scheduled Task/Job
T1609 Container Administration Command
T1098 Account Manipulation
Add Owner To Application Add Owner To Group Add User AddPermission20150331v2 AddUserToGroup Admin Registered Security Info AttachGroupPolicy AttachRolePolicy AttachUserPolicy ChangePassword compute.disks.setIamPolicy Consent To Application CreateAccessEntry CreatePolicy CreatePolicyVersion CreateRole CreateStack CreateUser CreateVirtualMFADevice EnableServiceAccount google.iam.admin.v1.SetIamPolicy iam.roles.update Microsoft.KeyVault/vaults/accessPolicies/write Microsoft.ManagedIdentity/userAssignedIdentities/assign/action PutGroupPolicy PutRolePolicy PutUserPolicy Reset User Password SetDefaultPolicyVersion Update User Authentication Methods UpdateAccessKey UpdateAssumeRolePolicy UpdateFunctionConfiguration20150331v2 UpdateLoginProfile
T1098.003 Additional Cloud Roles
T1098.004 SSH Authorized Keys
T1546 Event Triggered Execution
T1098.001 Additional Cloud Credentials
T1136.003 Cloud Account
T1556.006 Multi-Factor Authentication
T1078.004 Cloud Accounts
T1556 Modify Authentication Process
T1053 Scheduled Task/Job
T1098 Account Manipulation
Add Owner To Application Add Owner To Group AddPermission20150331v2 AddUserToGroup AssociateIamInstanceProfile AttachGroupPolicy AttachRolePolicy AttachUserPolicy compute.disks.setIamPolicy compute.instances.setServiceAccount Consent To Application CreateAccessEntry CreateDevEndpoint CreatePolicy CreatePolicyVersion CreateRole EnableServiceAccount google.iam.admin.v1.SetIamPolicy iam.roles.update Microsoft.KeyVault/vaults/accessPolicies/write Microsoft.ManagedIdentity/userAssignedIdentities/assign/action PutGroupPolicy PutKeyPolicy PutRolePolicy PutUserPolicy ReplaceIamInstanceProfileAssociation SetDefaultPolicyVersion UpdateAssumeRolePolicy UpdateDevEndpoint UpdateFunctionConfiguration20150331v2
T1078.004 Cloud Accounts
T1098.003 Additional Cloud Roles
Add App Role Assignment To Service Principal Add Eligible Member To Role In Pim Completed Add Member To Role Add Role Definition add-iam-policy-binding CreateRole CreateServiceLinkedRole Microsoft.Authorization/roleAssignments/write Microsoft.Directory/groups/members/update storage.setIamPermissions Update Role Definition
T1548 Abuse Elevation Control Mechanism
T1098.001 Additional Cloud Credentials
T1484.002 Trust Modification
T1548.005 Temporary Elevated Cloud Access
T1546 Event Triggered Execution
T1078.004 Cloud Accounts
AddRoleToInstanceProfile AssumeRole AssumeRoleWithSAML AssumeRoleWithWebIdentity ConsoleLogin generateAccessToken GetFederationToken GetSessionToken iam.serviceAccounts.actAs iam.serviceAccounts.implicitDelegation iam.serviceAccounts.signJwt Microsoft.Authorization/elevateAccess/action PassRole PasswordRecoveryRequested
T1070 Indicator Removal
T1535 Unused/Unsupported Cloud Regions
T1685 Disable or Modify Tools
ArchiveFindings CreateFilter CreateIPSet DeleteAlarms DeleteBucket DeleteConfigRule DeleteConfigurationRecorder DeleteDeliveryChannel DeleteDetector DeleteLoginProfile DeleteMembers DeleteRolePolicy DeleteUserPolicy DetachRolePolicy DetachUserPolicy DisassociateFromMasterAccount DisassociateMembers google.cloud.securitycenter.v1.SecurityCenter.SetMute LeaveOrganization Microsoft.HybridCompute/machines/extensions/delete Microsoft.Insights/activityLogAlerts/delete Microsoft.Insights/metricAlerts/delete Microsoft.Security/alertsSuppressionRules/write Microsoft.Security/autoProvisioningSettings/write Microsoft.Security/pricings/write Microsoft.Security/securitySolutions/delete RemoveAccountFromOrganization ScheduleKeyDeletion Securitycenter.settings.update StopConfigurationRecorder StopMonitoringMembers UpdateDetector UpdateIPSet
T1685.002 Disable or Modify Cloud Log
DeleteEventDataStore DeleteFlowLogs DeleteLogGroup DeleteLogStream DeleteObjects DeleteTrail google.logging.v2.ConfigServiceV2.UpdateExclusion google.logging.v2.LoggingServiceV2.DeleteLog logging.projects.exclusions.create logging.sinks.delete logging.sinks.update Microsoft.EventHub/namespaces/eventhubs/delete Microsoft.Insights/diagnosticSettings/delete Microsoft.Network/networkWatchers/flowLogs/delete Microsoft.OperationalInsights/workspaces/delete Microsoft.Storage/storageAccounts/stopLogging/action PutBucketLifecycleConfiguration PutEventSelectors StopLogging UpdateTrail
T1686.001 Cloud Firewall
AuthorizeDBSecurityGroupIngress AuthorizeSecurityGroupEgress AuthorizeSecurityGroupIngress compute.firewalls.delete compute.firewalls.patch CreateNetworkAclEntry DeleteNetworkAcl DeleteNetworkAclEntry DeleteRuleGroup DeleteWebACL Microsoft.Network/networkSecurityGroups/delete Microsoft.Network/networkSecurityGroups/securityRules/write VaultPatch
T1556.006 Multi-Factor Authentication
T1556.009 Conditional Access Policies
T1484.002 Trust Modification
T1578 Modify Cloud Compute Infrastructure
T1578.003 Delete Cloud Instance
T1599 Network Boundary Bridging
T1552 Unsecured Credentials
GetAuthorizationToken GetPasswordData Microsoft.AppConfiguration/configurationStores/listKeys/action Microsoft.Automation/automationAccounts/credentials/read Microsoft.Batch/batchAccounts/listKeys/action Microsoft.ContainerRegistry/registries/listCredentials/action Microsoft.ContainerService/managedClusters/listClusterAdminCredential/action Microsoft.ContainerService/managedClusters/listClusterUserCredential/action Microsoft.OperationalInsights/workspaces/sharedKeys/action Microsoft.ServiceBus/namespaces/authorizationRules/listKeys/action Microsoft.Storage/storageAccounts/listKeys/action Microsoft.Storage/storageAccounts/regenerateKey/action Microsoft.Web/sites/host/listKeys/action
T1555.006 Cloud Secrets Management Stores
T1528 Steal Application Access Token
T1526 Cloud Service Discovery
T1530 Data from Cloud Storage
CopyBlob CopyObject CreateDBSnapshot CreateImage CreateInstanceExportTask CreateSnapshot DeleteBucketPolicy GetObject Microsoft.Compute/disks/beginGetAccess/action Microsoft.Compute/snapshots/beginGetAccess/action Microsoft.Sql/servers/databases/export/action ModifyDBSnapshotAttribute ModifyImageAttribute ModifySnapshotAttribute PutBucketAcl PutBucketPolicy PutBucketPublicAccessBlock RestoreDBInstanceFromDBSnapshot SharedSnapshotCopyInitiated SharedSnapshotVolumeCreated StartExportTask storage.setIamPermissions
T1537 Transfer Data to Cloud Account
bigquery.jobs.insert cloudsql.instances.export CopyBlob CopyObject CreateDBSnapshot CreateImage CreateInstanceExportTask CreateSnapshot GetObject Microsoft.Compute/disks/beginGetAccess/action Microsoft.Compute/snapshots/beginGetAccess/action Microsoft.Sql/servers/databases/export/action ModifyDBInstance ModifyDBSnapshotAttribute ModifyImageAttribute ModifySnapshotAttribute PutBucketAcl PutBucketPolicy PutBucketReplication RestoreDBInstanceFromDBSnapshot SharedSnapshotCopyInitiated SharedSnapshotVolumeCreated StartExportTask
T1048 Exfiltration Over Alternative Protocol
T1485 Data Destruction
DeleteBucket DeleteDBCluster DeleteDBInstance DeleteFileSystem DeleteGlobalCluster DeleteObject DeleteObjects DeleteSnapshot DeleteVolume Microsoft.Authorization/locks/delete Microsoft.Compute/virtualMachines/delete Microsoft.EventHub/namespaces/eventhubs/delete Microsoft.KeyVault/vaults/delete Microsoft.KeyVault/vaults/secrets/delete Microsoft.OperationalInsights/workspaces/delete Microsoft.RecoveryServices/vaults/backupProtectedItems/delete Microsoft.Sql/servers/databases/delete Microsoft.Storage/storageAccounts/blobServices/containers/delete Microsoft.Storage/storageAccounts/delete PutBucketLifecycle PutBucketLifecycleConfiguration ScheduleKeyDeletion secretmanager.secrets.delete SecretManagerService.DestroySecretVersion storage.buckets.delete storage.objects.delete TerminateInstances
T1531 Account Access Removal
T1490 Inhibit System Recovery
T1489 Service Stop