1. Home
  2. Matrices
  3. Enterprise
  4. IaaS

IaaS Matrix

Below are the tactics and techniques representing the MITRE ATT&CK® IaaS platform. The techniques below are known to target cloud-based infrastructure-as-a-service (IaaS) platforms. IaaS encompasses cloud-hosted infrastructure, such as virtual machines, object storage, databases, and serverless functionality. The Matrix contains information for the IaaS platform.

View on the ATT&CK® Navigator
Version Permalink
Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Exfiltration Impact
3 techniques 4 techniques 6 techniques 4 techniques 9 techniques 8 techniques 14 techniques 2 techniques 4 techniques 2 techniques 8 techniques
Exploit Public-Facing Application
Trusted Relationship
Valid Accounts (2)
=
Cloud Administration Command
Command and Scripting Interpreter (1)
=
Serverless Execution
User Execution (1)
=
Account Manipulation (3)
=
Create Account (1)
=
Event Triggered Execution
Implant Internal Image
Modify Authentication Process (3)
=
Valid Accounts (2)
=
Abuse Elevation Control Mechanism (1)
=
Account Manipulation (3)
=
Event Triggered Execution
Valid Accounts (2)
=
Abuse Elevation Control Mechanism (1)
=
Exploitation for Defense Evasion
Impair Defenses (3)
=
Modify Authentication Process (3)
=
Modify Cloud Compute Infrastructure (5)
=
Modify Cloud Resource Hierarchy
Unused/Unsupported Cloud Regions
Use Alternate Authentication Material (2)
=
Valid Accounts (2)
=
Brute Force (3)
=
Credentials from Password Stores (1)
=
Forge Web Credentials (2)
=
Modify Authentication Process (3)
=
Multi-Factor Authentication Request Generation
Network Sniffing
Steal Application Access Token
Unsecured Credentials (2)
=
Account Discovery (1)
=
Cloud Infrastructure Discovery
Cloud Service Dashboard
Cloud Service Discovery
Cloud Storage Object Discovery
Log Enumeration
Network Service Discovery
Network Sniffing
Password Policy Discovery
Permission Groups Discovery (1)
=
Software Discovery (1)
=
System Information Discovery
System Location Discovery
System Network Connections Discovery
Remote Services (2)
=
Use Alternate Authentication Material (2)
=
Automated Collection
Data from Cloud Storage
Data from Information Repositories
Data Staged (1)
=
Exfiltration Over Alternative Protocol
Transfer Data to Cloud Account
Account Access Removal
Data Destruction (1)
=
Data Encrypted for Impact
Defacement (1)
=
Endpoint Denial of Service (3)
=
Inhibit System Recovery
Network Denial of Service (2)
=
Resource Hijacking (2)
=
Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Exfiltration Impact
3 techniques 4 techniques 6 techniques 4 techniques 9 techniques 8 techniques 14 techniques 2 techniques 4 techniques 2 techniques 8 techniques
Exploit Public-Facing Application
Trusted Relationship
=
Valid Accounts (2)
Cloud Administration Command
=
Command and Scripting Interpreter (1)
Serverless Execution
=
User Execution (1)
=
Account Manipulation (3)
=
Create Account (1)
Event Triggered Execution
Implant Internal Image
=
Modify Authentication Process (3)
=
Valid Accounts (2)
=
Abuse Elevation Control Mechanism (1)
=
Account Manipulation (3)
Event Triggered Execution
=
Valid Accounts (2)
=
Abuse Elevation Control Mechanism (1)
Exploitation for Defense Evasion
=
Impair Defenses (3)
=
Modify Authentication Process (3)
=
Modify Cloud Compute Infrastructure (5)
Modify Cloud Resource Hierarchy
Unused/Unsupported Cloud Regions
=
Use Alternate Authentication Material (2)
=
Valid Accounts (2)
=
Brute Force (3)
=
Credentials from Password Stores (1)
=
Forge Web Credentials (2)
=
Modify Authentication Process (3)
Multi-Factor Authentication Request Generation
Network Sniffing
Steal Application Access Token
=
Unsecured Credentials (2)
=
Account Discovery (1)
Cloud Infrastructure Discovery
Cloud Service Dashboard
Cloud Service Discovery
Cloud Storage Object Discovery
Log Enumeration
Network Service Discovery
Network Sniffing
Password Policy Discovery
=
Permission Groups Discovery (1)
=
Software Discovery (1)
System Information Discovery
System Location Discovery
System Network Connections Discovery
=
Remote Services (2)
=
Use Alternate Authentication Material (2)
Automated Collection
Data from Cloud Storage
Data from Information Repositories
=
Data Staged (1)
Exfiltration Over Alternative Protocol
Transfer Data to Cloud Account
Account Access Removal
=
Data Destruction (1)
Data Encrypted for Impact
=
Defacement (1)
=
Endpoint Denial of Service (3)
Inhibit System Recovery
=
Network Denial of Service (2)
=
Resource Hijacking (2)