1. Home
  2. Matrices
  3. Enterprise
  4. SaaS

SaaS Matrix

Below are the tactics and techniques representing the MITRE ATT&CK® Matrix for Enterprise covering cloud-based techniques. The Matrix contains information for the SaaS platform.

View on the ATT&CK® Navigator
Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Exfiltration Impact
4 techniques 2 techniques 5 techniques 4 techniques 6 techniques 7 techniques 4 techniques 4 techniques 3 techniques 3 techniques 4 techniques
Drive-by Compromise
Phishing (2)
=
Trusted Relationship
Valid Accounts (2)
=
Serverless Execution
Software Deployment Tools
Account Manipulation (3)
=
Create Account (1)
=
Event Triggered Execution
Modify Authentication Process (3)
=
Valid Accounts (2)
=
Account Manipulation (3)
=
Domain or Tenant Policy Modification (1)
=
Event Triggered Execution
Valid Accounts (2)
=
Domain or Tenant Policy Modification (1)
=
Exploitation for Defense Evasion
Impersonation
Modify Authentication Process (3)
=
Use Alternate Authentication Material (2)
=
Valid Accounts (2)
=
Brute Force (3)
=
Forge Web Credentials (2)
=
Modify Authentication Process (3)
=
Multi-Factor Authentication Request Generation
Steal Application Access Token
Steal Web Session Cookie
Unsecured Credentials (1)
=
Account Discovery (1)
=
Cloud Service Dashboard
Cloud Service Discovery
Permission Groups Discovery (1)
=
Internal Spearphishing
Software Deployment Tools
Taint Shared Content
Use Alternate Authentication Material (2)
=
Automated Collection
Data from Cloud Storage
Data from Information Repositories (2)
=
Exfiltration Over Alternative Protocol
Exfiltration Over Web Service (1)
=
Transfer Data to Cloud Account
Account Access Removal
Endpoint Denial of Service (3)
=
Financial Theft
Network Denial of Service (2)
=
Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Exfiltration Impact
4 techniques 2 techniques 5 techniques 4 techniques 6 techniques 7 techniques 4 techniques 4 techniques 3 techniques 3 techniques 4 techniques
Drive-by Compromise
=
Phishing (2)
Trusted Relationship
=
Valid Accounts (2)
Serverless Execution
Software Deployment Tools
=
Account Manipulation (3)
=
Create Account (1)
Event Triggered Execution
=
Modify Authentication Process (3)
=
Valid Accounts (2)
=
Account Manipulation (3)
=
Domain or Tenant Policy Modification (1)
Event Triggered Execution
=
Valid Accounts (2)
=
Domain or Tenant Policy Modification (1)
Exploitation for Defense Evasion
Impersonation
=
Modify Authentication Process (3)
=
Use Alternate Authentication Material (2)
=
Valid Accounts (2)
=
Brute Force (3)
=
Forge Web Credentials (2)
=
Modify Authentication Process (3)
Multi-Factor Authentication Request Generation
Steal Application Access Token
Steal Web Session Cookie
=
Unsecured Credentials (1)
=
Account Discovery (1)
Cloud Service Dashboard
Cloud Service Discovery
=
Permission Groups Discovery (1)
Internal Spearphishing
Software Deployment Tools
Taint Shared Content
=
Use Alternate Authentication Material (2)
Automated Collection
Data from Cloud Storage
=
Data from Information Repositories (2)
Exfiltration Over Alternative Protocol
=
Exfiltration Over Web Service (1)
Transfer Data to Cloud Account
Account Access Removal
=
Endpoint Denial of Service (3)
Financial Theft
=
Network Denial of Service (2)