I'm Doing My Part! By Mapping Cloud Incidents to ATT&CK Techniques

Why Map Cloud Incidents to ATT&CK

MITRE ATT&CK enterprise lead Casey Nur argues mapping threat reports to ATT&CK techniques enables a common language for sharing intelligence, spotting trends, and finding defensive gaps. ATT&CK Cloud spans IaaS, SaaS, Google Workspace, Office 365, and Azure AD (with ongoing cleanup as platforms evolve).

Three Mapping Questions

Analysts must extract atomic behaviors from prose, determine adversary goals to select tactics (often intertwined in cloud), then match techniques and sub-techniques using descriptions and keyword search. Multiple techniques may apply; perfection is less important than consistent community feedback.

Worked Example: Midnight Blizzard

Using Microsoft reporting on APT29/Midnight Blizzard, Nur isolates password spraying against a non-MFA test tenant with low-and-slow attempts to evade detection. She notes cloud mapping can feel repetitive when reports collapse to valid cloud accounts, but diverse techniques exist beyond that pattern when reports are parsed carefully.