Tactics

Reconnaissance	Initial Access	Persistence	Defense Evasion	Credential Access	Discovery	Lateral Movement	Exfiltration	Impact
Storage account discovery	Valid SAS token	Firewall and virtual networks configuration changes	Firewall and virtual networks configuration changes	Access key query	Storage service discovery	Malicious content upload	Data transfer size limits	Data corruption
Search engines	Valid shared key	Role-based access control permission	Role-based access control permission	Cloud shell profiles	Account configuration discovery	Malware distribution	Automated exfiltration	Data manipulation
Databases of publicly available storage accounts	Authorized principal account	Create SAS token	Storage data clone	Unsecured communication channel		Trigger cross-service interaction	Static website	Data encryption for impact
DNS/Passive DNS	Anonymous public read access	Container access level property	Data transfer size limits			Code injection	Object replication
Victim-owned websites	SFTP Credentials	SFTP account	Automated exfiltration
	NFS Access	Trusted Azure services	Disable audit logs
	SMB Access	Trusted access based on a managed identity	Disable cloud workload protection
	Object replication	Private endpoint	Private endpoint
			Operations across geo replicas

Disclaimer

The purpose of the threat matrix for storage services is to educate readers on the potential tactics, techniques, and procedures (TTPs). It is not to teach how to weaponize or specifically abuse them.