Attack scenario
Cloud and SaaS compromise
An adversary abuses cloud identities, permissions, configurations, or application integrations to access services and data.
Why this scenario matters
This view connects the attack path with preventive, detective, response, and recovery controls and helps identify gaps between technologies.
The scenario uses MITRE ATT&CK® as a reference model. It is an expert SecTec interpretation and does not imply endorsement by MITRE.
Relevant ATT&CK tactics
- Collection
- Credential Access
- Defense Impairment
- Discovery
- Exfiltration
- Initial Access
- Persistence
- Privilege Escalation
- Stealth
Relevant ATT&CK techniques
- T1078 Valid Accounts
- T1098 Account Manipulation
- T1136 Create Account
- T1484 Domain or Tenant Policy Modification
- T1526 Cloud Service Discovery
- T1530 Data from Cloud Storage
- T1556 Modify Authentication Process
- T1578 Modify Cloud Compute Infrastructure
- T1580 Cloud Infrastructure Discovery
- T1567 Exfiltration Over Web Service
SecTec technologies and vendors
The following hierarchy is derived from the approved ATT&CK-to-technology and technology-to-vendor mappings.
Cloud Security
Endpoint Security
Network Security
Identity and Access Mgmt
- ABACTechnology
- IAM platformsTechnology
- Identity GovernanceTechnology
- Identity LifecycleTechnology
- IGATechnology
- JEATechnology
- JITTechnology
- MFATechnology
- PAMTechnology
- PBACTechnology
- PIMTechnology
- Proximity VerificationTechnology
- RBACTechnology
- ReBACTechnology
- Risk Based AuthenticationTechnology
- SCIMTechnology
- SSOTechnology