Subdomain takeover

Info

ID: MS-TA7001
Tactic: Resource Development
MITRE technique: T1584.001

Deleting a cloud application or service without removing its associated DNS record can leave the organization susceptible to subdomain takeover. An attacker who registers a resource at the same address (e.g., a cloud function, app service, or storage endpoint) can hijack traffic intended for the original service, potentially serving malicious content or harvesting credentials.

Mitigations

ID	Mitigation	Description
MS-M7001	Remove DNS records on resource deletion	Delete or update DNS entries immediately when decommissioning cloud applications or services to prevent subdomain takeover.
MS-M7002	Implement domain ownership verification	Use cloud provider domain verification mechanisms to ensure only authorized services can claim domains.
MS-M7003	Use randomized service endpoints	Some cloud providers offer to add a random suffix to the site name, making it unique even after deletion.