MICROSOFT has introduced the Cloud web applications threat matrix, a MITRE ATT&CK-aligned framework designed to help defenders understand, prioritise, and mitigate threats to cloud-hosted web apps and serverless platforms. The matrix maps techniques across cloud-native environments and focuses on attack paths that span application code, managed runtimes, workload identities, deployment pipelines, and connected cloud resources.
It organises techniques by ATT&CK tactics such as Resource Development, Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion, Credential Access, Discovery, Lateral Movement, Collection and Impact, with the aim of helping security teams identify visibility gaps, prioritise hardening, and plan investigations that cross the app layer and the underlying cloud platform.
The technique catalog walks through each tactic with concrete examples. In Resource Development, for instance, subdomain takeovers arise when DNS records point to reusable provider endpoints that are deleted or left orphaned, potentially letting an attacker intercept traffic. Initial Access covers Application vulnerability, Code injection in connected repository, Compromised image in registry, Exposed/misconfigured admin interfaces, Serverless trigger injection, and Using deployment credentials.
Execution includes Application exploit (remote code execution), Cloud native terminal, and Site extensions. Privilege Escalation highlights accessing cloud resources and workload identity credentials. Defense Evasion notes development slots and disabling cloud logging. Other techniques summary includes Brute force, Cloud credentials in runtime, Access to connected cloud storage, Cloud service discovery, Instance metadata API, Connector reuse, Access to application databases, and Event data capture.
The article emphasises mitigation and protection guidance—across visibility, least-privilege, trusted sources for code and extensions, protecting pipelines and logs, and employing backups and recovery plans—while noting Defender for Cloud and Defender XDR can support investigation and response.