Access application database

Info

ID: MS-TA7025
Tactic: Collection
MITRE technique: T1213

Many applications rely on a connected database to store application data, user information, configuration values, or state. The application often connects to the database by using the application cloud identity, or by using a hardcoded connection string. If an attacker gains code execution abilities, they can interact with the database - query and extract data or modify entries. In cases where the database is accessible from the internet, attacker may only need read permissions over the web app to access the database.

Mitigations

ID	Mitigation	Description
MS-M7017	Implement least-privilege access	Grant applications and identities only the database permissions required for their function.
MS-M7013	Restrict network access to sensitive services	Use private endpoints, VPC/VNET integration, or firewall rules to prevent direct internet access to databases.
MS-M7038	Use parameterized queries	Implement prepared statements and parameterized queries to prevent SQL injection and unauthorized query manipulation.