Azure Attack Mappings
Last updated
Last updated
The Azure MITRE ATT&CK Mappings project, developed by the Center for Threat-Informed Defense in collaboration with Microsoft and MITRE, provides a comprehensive mapping of Azure-specific attack behaviors to the MITRE ATT&CK framework. It translates real-world adversary techniques used in Microsoft Azure environments—such as privilege escalation via role assignments, disabling logging, or credential abuse—into ATT&CK tactics and techniques. This resource enables defenders, threat hunters, and red teams to better understand how threats manifest in Azure and to align detection, prevention, and response strategies using a threat-informed approach. By mapping cloud-native actions to ATT&CK, the project helps organizations improve visibility, strengthen cloud defense, and simulate realistic attack scenarios across Azure services.
