Tactics

Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Impact
Subdomain takeover	Application vulnerability	Application exploit (RCE)	Cron jobs	Access cloud resources	Development slots	Access workload identity credentials	Access to connected cloud storage	Access cloud resources	Access application database	Data destruction
	Code injection in connected repository	Cloud native terminal	Source code modification	Access workload identity credentials	Disable cloud logging	Brute force	Cloud service discovery	Connector reuse	Event data capture	Data theft
	Compromised image in registry	Development slots	Valid cloud accounts			Cloud credentials in runtime environment	Instance metadata API	Server side request forgery (SSRF)		Defacement
	Exposed/misconfigured admin interfaces	Site extensions								Denial of wallet
	Serverless trigger injection									Resource hijacking
	Using deployment credentials
	Valid cloud accounts

Disclaimer

The purpose of the Threat Matrix for Cloud Web Applications is to educate readers on the potential of cloud web application-based tactics, techniques, and procedures (TTPs). It is not to teach how to weaponize or specifically abuse them.