Security1 publisher2 min readPublished
Microsoft maps stale DNS and commit rights into one cloud web app attack surface
The new cloud web applications threat matrix sorts eleven ATT&CK tactics for managed runtimes and serverless code, starting with assets an app team rarely owns, such as dead DNS records and linked source repositories.
The Watch · Security desk
What happened
- Microsoft published the cloud web applications threat matrix, an ATT&CK-aligned framework for threats to cloud-hosted web applications and serverless platforms.
- Its stated premise is that attack paths cross application code, managed runtimes, workload identities, deployment pipelines and connected cloud resources, and that investigating app and platform separately leaves gaps.
- Techniques are organized under eleven tactics, running from Resource Development through Impact.
- The matrix extends the treatment Microsoft previously gave to Kubernetes and to storage services, this time covering code that runs in a managed environment and is usually internet-facing.
- Microsoft positions it as a tool for assessing visibility gaps, prioritizing hardening and planning investigations across cloud-native environments.
Compiled by The WatchSomething wrong?How this is made
Why it matters
- exposure Commit rights on a linked repository and write access to a referenced image registry are production execution rights, a group most access reviews still scope as non-production.
- constraint With no frequency data attached, the matrix cannot rank anything for a defender; it can only expose which rows have no telemetry behind them, and the ordering stays a local judgment.
- capability It gives an app-side finding and a cloud control-plane alert a common vocabulary, so they can be filed as one attack path instead of two unrelated tickets in two queues.
- precedent Kubernetes, storage and now cloud web apps make per-service ATT&CK matrices Microsoft's standing unit of cloud threat documentation, which coverage tooling will be expected to map against.
Subdomain takeover is the cleanest version of the seam Microsoft is describing. A team deletes a cloud app or service and leaves the DNS record pointing at a reusable provider endpoint. Depending on the provider's behavior, the service configuration and naming constraints, another party can then register a resource that claims the same address, intercept traffic intended for the original service, and serve malicious content or harvest credentials [6]. There is no application to patch in that path, and no application log to search.
The ordinary case is in the matrix too: a public-facing app carrying a flaw in its own code, its framework or a third-party dependency, giving an adversary execution in the app's context or a route to internal resources [7]. Next to it sits the pipeline. Microsoft's worked example is an actor with commit permissions on a GitHub repository configured to deploy GCP Cloud Functions through Cloud Build triggers, where the injected code ships into production under the legitimate workflow [8]. Container image supply is the same shape, because an app that deploys from a private or public registry runs whatever an actor with registry access planted or updated there [9].
The taxonomy has a gap: it lists Collection as a tactic but leaves out Exfiltration [11]. A team mapping existing detections onto the rows has nowhere obvious to file data egress unless it folds that under Impact. The post also carries no frequency evidence: it does not cite a CVE, name an actor, or date an intrusion [14]. It reads as a technique inventory, not telemetry.
Three of the techniques detailed in the opening section turn on assets outside the running application: a DNS record, a source repository, and a container registry [12]. Each lives in a separate log, often under separate retention, and an application-scoped investigation reaches none of them. The matrix supplies the rows. Putting owners and log sources against them is local work, and that is where the gap Microsoft describes closes.
What to watch
- Whether Microsoft publishes technique IDs and detection queries for each row, which is what makes a matrix usable in a SOC coverage review.
- Whether a later revision adds an Exfiltration tactic or formally folds data egress under Impact.
- Whether Microsoft attaches observed intrusion data to the techniques, turning the inventory into a ranking.