{"source_checked_on":"2026-10-19","schema_version":1,"key":"enterprise/T1578","id":"T1578","name":"Modify Cloud Compute Infrastructure","domain":"enterprise","reviewed_on":"2026-09-28","source_url":"https://attack.mitre.org/techniques/T1578","source_file":{"file":"enterprise.json","url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/20664a889568dce884a1dac0ec7b12ae3a199f51/enterprise-attack/enterprise-attack-20.0.json","sha256":"81113ba98afa2928f3dcff62022539f7ce30c315c32e14422f11ff95ce534352","bytes":55271014},"source_object_sha256":"24a53d312b3089cfdc616d93277f044bee56e2cab6d4ec5150a4b82668d2a78a","description":"An adversary may attempt to modify a cloud account's compute service infrastructure to evade defenses. A modification to the compute service infrastructure can include the creation, deletion, or modification of one or more components such as compute instances, virtual machines, and snapshots.\n\nPermissions gained from the modification of infrastructure components may bypass restrictions that prevent access to existing infrastructure. Modifying infrastructure components may also allow an adversary to evade detection and remove evidence of their presence.(Citation: Mandiant M-Trends 2020)","references":[{"source_name":"mitre-attack","url":"https://attack.mitre.org/techniques/T1578","external_id":"T1578"},{"source_name":"Mandiant M-Trends 2020","description":"Mandiant. (2020, February). M-Trends 2020. Retrieved November 17, 2024.","url":"https://www.mandiant.com/sites/default/files/2021-09/mtrends-2020.pdf"}],"platforms":["IaaS"],"environments":["cloud"],"visibility":"source_mapped","visibility_note":null,"parent":null,"children":[{"key":"enterprise/T1578.001","id":"T1578.001","name":"Create Snapshot","page":"techniques/enterprise/T1578.001/"},{"key":"enterprise/T1578.002","id":"T1578.002","name":"Create Cloud Instance","page":"techniques/enterprise/T1578.002/"},{"key":"enterprise/T1578.003","id":"T1578.003","name":"Delete Cloud Instance","page":"techniques/enterprise/T1578.003/"},{"key":"enterprise/T1578.004","id":"T1578.004","name":"Revert Cloud Instance","page":"techniques/enterprise/T1578.004/"},{"key":"enterprise/T1578.005","id":"T1578.005","name":"Modify Cloud Compute Configurations","page":"techniques/enterprise/T1578.005/"}],"telemetry":[{"id":"DC0070","name":"Cloud Service Metadata","page":"telemetry/DC0070/","kind":"attack_component","category":"Cloud control plane","description":"Cloud service inventory and current configuration.","collection_focus":"Export service configuration with resource ID, region, status and enabled logging features using least-privileged read access.","providers":[{"name":"AWS CloudTrail","scope":"Management-plane API activity; supported resource/data events require separate selectors.","source_id":"cloudtrail"},{"name":"Azure Monitor Activity Log","scope":"Azure resource control-plane operations; resource data-plane logs are separate.","source_id":"azure"},{"name":"Google Cloud Audit Logs","scope":"Admin Activity and other categories; configure Data Access where required.","source_id":"gcp"}],"configuration":["In the isolated account/project/subscription, route administrative audit logs to a protected destination with retention and access controls.","Select the relevant service, regions and read/write operations. Confirm whether the API below is a management or data event in the provider documentation.","Preserve actor/session, resource, request ID, service, operation, region and error details. Check delivery latency and avoid logging credentials or sensitive request bodies."],"configuration_example":null,"required_fields":["resource_id","service","enabled","retention_days"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0070","collector":"illustrative-lab-collector","observation":{"resource_id":"lab-service-1","service":"lab-audit-service","enabled":true,"retention_days":30}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"AWS, Azure and Google expose different APIs and event schemas. An accepted API request does not prove the final resource state; join asynchronous outcomes and inventory.","sources":[{"id":"cloudtrail","title":"AWS CloudTrail event categories","url":"https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-events.html"},{"id":"ec2","title":"AWS EC2 API logging with CloudTrail","url":"https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/monitor-with-cloudtrail.html"},{"id":"azure","title":"Azure Monitor Activity Log","url":"https://learn.microsoft.com/en-us/azure/azure-monitor/fundamentals/activity-log"},{"id":"gcp","title":"Google Cloud Audit Logs","url":"https://docs.cloud.google.com/logging/docs/audit"}],"association":"attack_component","anomaly_design":"Per account, role, region and API: rare actions, new role-resource relationships, enumeration bursts and configuration changes. Separate deployment automation and organization-level administrative activity."},{"id":"DC0080","name":"Instance Start","page":"telemetry/DC0080/","kind":"attack_component","category":"Cloud control plane","description":"A request to start a stopped compute instance and its resulting state.","collection_focus":"Collect start APIs and instance-state transitions with request IDs; distinguish accepted from completed.","providers":[{"name":"AWS CloudTrail","scope":"Management-plane API activity; supported resource/data events require separate selectors.","source_id":"cloudtrail"},{"name":"Azure Monitor Activity Log","scope":"Azure resource control-plane operations; resource data-plane logs are separate.","source_id":"azure"},{"name":"Google Cloud Audit Logs","scope":"Admin Activity and other categories; configure Data Access where required.","source_id":"gcp"}],"configuration":["In the isolated account/project/subscription, route administrative audit logs to a protected destination with retention and access controls.","Select the relevant service, regions and read/write operations. Confirm whether the API below is a management or data event in the provider documentation.","Preserve actor/session, resource, request ID, service, operation, region and error details. Check delivery latency and avoid logging credentials or sensitive request bodies."],"configuration_example":null,"required_fields":["instance_id","action","state_before","state_after"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0080","collector":"illustrative-lab-collector","observation":{"instance_id":"vm-lab-1","action":"start","state_before":"stopped","state_after":"pending"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"AWS, Azure and Google expose different APIs and event schemas. An accepted API request does not prove the final resource state; join asynchronous outcomes and inventory.","sources":[{"id":"cloudtrail","title":"AWS CloudTrail event categories","url":"https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-events.html"},{"id":"ec2","title":"AWS EC2 API logging with CloudTrail","url":"https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/monitor-with-cloudtrail.html"},{"id":"azure","title":"Azure Monitor Activity Log","url":"https://learn.microsoft.com/en-us/azure/azure-monitor/fundamentals/activity-log"},{"id":"gcp","title":"Google Cloud Audit Logs","url":"https://docs.cloud.google.com/logging/docs/audit"}],"association":"attack_component","anomaly_design":"Per account, role, region and API: rare actions, new role-resource relationships, enumeration bursts and configuration changes. Separate deployment automation and organization-level administrative activity."},{"id":"DC0089","name":"Instance Stop","page":"telemetry/DC0089/","kind":"attack_component","category":"Cloud control plane","description":"Stopping a compute instance without necessarily deleting it.","collection_focus":"Collect stop API requests and resulting state; correlate with approved maintenance and resource health.","providers":[{"name":"AWS CloudTrail","scope":"Management-plane API activity; supported resource/data events require separate selectors.","source_id":"cloudtrail"},{"name":"Azure Monitor Activity Log","scope":"Azure resource control-plane operations; resource data-plane logs are separate.","source_id":"azure"},{"name":"Google Cloud Audit Logs","scope":"Admin Activity and other categories; configure Data Access where required.","source_id":"gcp"}],"configuration":["In the isolated account/project/subscription, route administrative audit logs to a protected destination with retention and access controls.","Select the relevant service, regions and read/write operations. Confirm whether the API below is a management or data event in the provider documentation.","Preserve actor/session, resource, request ID, service, operation, region and error details. Check delivery latency and avoid logging credentials or sensitive request bodies."],"configuration_example":null,"required_fields":["instance_id","action","state_before","state_after"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0089","collector":"illustrative-lab-collector","observation":{"instance_id":"vm-lab-1","action":"stop","state_before":"running","state_after":"stopping"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"AWS, Azure and Google expose different APIs and event schemas. An accepted API request does not prove the final resource state; join asynchronous outcomes and inventory.","sources":[{"id":"cloudtrail","title":"AWS CloudTrail event categories","url":"https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-events.html"},{"id":"ec2","title":"AWS EC2 API logging with CloudTrail","url":"https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/monitor-with-cloudtrail.html"},{"id":"azure","title":"Azure Monitor Activity Log","url":"https://learn.microsoft.com/en-us/azure/azure-monitor/fundamentals/activity-log"},{"id":"gcp","title":"Google Cloud Audit Logs","url":"https://docs.cloud.google.com/logging/docs/audit"}],"association":"attack_component","anomaly_design":"Per account, role, region and API: rare actions, new role-resource relationships, enumeration bursts and configuration changes. Separate deployment automation and organization-level administrative activity."},{"id":"DC0057","name":"Snapshot Creation","page":"telemetry/DC0057/","kind":"attack_component","category":"Cloud control plane","description":"Creation of a snapshot or recovery-point artifact.","collection_focus":"Collect snapshot-create APIs and subsequent state; link snapshot to source volume/instance and requesting principal.","providers":[{"name":"AWS CloudTrail","scope":"Management-plane API activity; supported resource/data events require separate selectors.","source_id":"cloudtrail"},{"name":"Azure Monitor Activity Log","scope":"Azure resource control-plane operations; resource data-plane logs are separate.","source_id":"azure"},{"name":"Google Cloud Audit Logs","scope":"Admin Activity and other categories; configure Data Access where required.","source_id":"gcp"}],"configuration":["In the isolated account/project/subscription, route administrative audit logs to a protected destination with retention and access controls.","Select the relevant service, regions and read/write operations. Confirm whether the API below is a management or data event in the provider documentation.","Preserve actor/session, resource, request ID, service, operation, region and error details. Check delivery latency and avoid logging credentials or sensitive request bodies."],"configuration_example":null,"required_fields":["snapshot_id","source_volume","action","state"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0057","collector":"illustrative-lab-collector","observation":{"snapshot_id":"snap-lab-1","source_volume":"vol-lab-1","action":"create","state":"pending"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"AWS, Azure and Google expose different APIs and event schemas. An accepted API request does not prove the final resource state; join asynchronous outcomes and inventory.","sources":[{"id":"cloudtrail","title":"AWS CloudTrail event categories","url":"https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-events.html"},{"id":"ec2","title":"AWS EC2 API logging with CloudTrail","url":"https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/monitor-with-cloudtrail.html"},{"id":"azure","title":"Azure Monitor Activity Log","url":"https://learn.microsoft.com/en-us/azure/azure-monitor/fundamentals/activity-log"},{"id":"gcp","title":"Google Cloud Audit Logs","url":"https://docs.cloud.google.com/logging/docs/audit"}],"association":"attack_component","anomaly_design":"Per account, role, region and API: rare actions, new role-resource relationships, enumeration bursts and configuration changes. Separate deployment automation and organization-level administrative activity."},{"id":"DC0049","name":"Snapshot Deletion","page":"telemetry/DC0049/","kind":"attack_component","category":"Cloud control plane","description":"Deletion of a resource snapshot or recovery-point artifact.","collection_focus":"Collect snapshot-delete control-plane events; join the immutable snapshot ID and completion state with backup inventory.","providers":[{"name":"AWS CloudTrail","scope":"Management-plane API activity; supported resource/data events require separate selectors.","source_id":"cloudtrail"},{"name":"Azure Monitor Activity Log","scope":"Azure resource control-plane operations; resource data-plane logs are separate.","source_id":"azure"},{"name":"Google Cloud Audit Logs","scope":"Admin Activity and other categories; configure Data Access where required.","source_id":"gcp"}],"configuration":["In the isolated account/project/subscription, route administrative audit logs to a protected destination with retention and access controls.","Select the relevant service, regions and read/write operations. Confirm whether the API below is a management or data event in the provider documentation.","Preserve actor/session, resource, request ID, service, operation, region and error details. Check delivery latency and avoid logging credentials or sensitive request bodies."],"configuration_example":null,"required_fields":["snapshot_id","action","actor","result"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0049","collector":"illustrative-lab-collector","observation":{"snapshot_id":"snap-lab-1","action":"delete","actor":"lab-admin","result":"requested"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"AWS, Azure and Google expose different APIs and event schemas. An accepted API request does not prove the final resource state; join asynchronous outcomes and inventory.","sources":[{"id":"cloudtrail","title":"AWS CloudTrail event categories","url":"https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-events.html"},{"id":"ec2","title":"AWS EC2 API logging with CloudTrail","url":"https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/monitor-with-cloudtrail.html"},{"id":"azure","title":"Azure Monitor Activity Log","url":"https://learn.microsoft.com/en-us/azure/azure-monitor/fundamentals/activity-log"},{"id":"gcp","title":"Google Cloud Audit Logs","url":"https://docs.cloud.google.com/logging/docs/audit"}],"association":"attack_component","anomaly_design":"Per account, role, region and API: rare actions, new role-resource relationships, enumeration bursts and configuration changes. Separate deployment automation and organization-level administrative activity."},{"id":"DC0058","name":"Snapshot Modification","page":"telemetry/DC0058/","kind":"attack_component","category":"Cloud control plane","description":"Changes to snapshot attributes, access policies or sharing state.","collection_focus":"Collect snapshot-attribute modifications and configuration snapshots; distinguish a permission change from modification of stored snapshot bytes.","providers":[{"name":"AWS CloudTrail","scope":"Management-plane API activity; supported resource/data events require separate selectors.","source_id":"cloudtrail"},{"name":"Azure Monitor Activity Log","scope":"Azure resource control-plane operations; resource data-plane logs are separate.","source_id":"azure"},{"name":"Google Cloud Audit Logs","scope":"Admin Activity and other categories; configure Data Access where required.","source_id":"gcp"}],"configuration":["In the isolated account/project/subscription, route administrative audit logs to a protected destination with retention and access controls.","Select the relevant service, regions and read/write operations. Confirm whether the API below is a management or data event in the provider documentation.","Preserve actor/session, resource, request ID, service, operation, region and error details. Check delivery latency and avoid logging credentials or sensitive request bodies."],"configuration_example":null,"required_fields":["snapshot_id","attribute","before","after"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0058","collector":"illustrative-lab-collector","observation":{"snapshot_id":"snap-lab-1","attribute":"shared_with","before":[],"after":["lab-account-2"]}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"AWS, Azure and Google expose different APIs and event schemas. An accepted API request does not prove the final resource state; join asynchronous outcomes and inventory.","sources":[{"id":"cloudtrail","title":"AWS CloudTrail event categories","url":"https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-events.html"},{"id":"ec2","title":"AWS EC2 API logging with CloudTrail","url":"https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/monitor-with-cloudtrail.html"},{"id":"azure","title":"Azure Monitor Activity Log","url":"https://learn.microsoft.com/en-us/azure/azure-monitor/fundamentals/activity-log"},{"id":"gcp","title":"Google Cloud Audit Logs","url":"https://docs.cloud.google.com/logging/docs/audit"}],"association":"attack_component","anomaly_design":"Per account, role, region and API: rare actions, new role-resource relationships, enumeration bursts and configuration changes. Separate deployment automation and organization-level administrative activity."},{"id":"DC0097","name":"Volume Creation","page":"telemetry/DC0097/","kind":"attack_component","category":"Cloud control plane","description":"Provisioning of a block-storage volume.","collection_focus":"Collect volume-create APIs with size, zone, encryption and actor; verify final provisioned state.","providers":[{"name":"AWS CloudTrail","scope":"Management-plane API activity; supported resource/data events require separate selectors.","source_id":"cloudtrail"},{"name":"Azure Monitor Activity Log","scope":"Azure resource control-plane operations; resource data-plane logs are separate.","source_id":"azure"},{"name":"Google Cloud Audit Logs","scope":"Admin Activity and other categories; configure Data Access where required.","source_id":"gcp"}],"configuration":["In the isolated account/project/subscription, route administrative audit logs to a protected destination with retention and access controls.","Select the relevant service, regions and read/write operations. Confirm whether the API below is a management or data event in the provider documentation.","Preserve actor/session, resource, request ID, service, operation, region and error details. Check delivery latency and avoid logging credentials or sensitive request bodies."],"configuration_example":null,"required_fields":["volume_id","action","size_gib","encrypted"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0097","collector":"illustrative-lab-collector","observation":{"volume_id":"vol-lab-1","action":"create","size_gib":8,"encrypted":true}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"AWS, Azure and Google expose different APIs and event schemas. An accepted API request does not prove the final resource state; join asynchronous outcomes and inventory.","sources":[{"id":"cloudtrail","title":"AWS CloudTrail event categories","url":"https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-events.html"},{"id":"ec2","title":"AWS EC2 API logging with CloudTrail","url":"https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/monitor-with-cloudtrail.html"},{"id":"azure","title":"Azure Monitor Activity Log","url":"https://learn.microsoft.com/en-us/azure/azure-monitor/fundamentals/activity-log"},{"id":"gcp","title":"Google Cloud Audit Logs","url":"https://docs.cloud.google.com/logging/docs/audit"}],"association":"attack_component","anomaly_design":"Per account, role, region and API: rare actions, new role-resource relationships, enumeration bursts and configuration changes. Separate deployment automation and organization-level administrative activity."},{"id":"DC0098","name":"Volume Deletion","page":"telemetry/DC0098/","kind":"attack_component","category":"Cloud control plane","description":"Deletion of a block-storage volume.","collection_focus":"Collect volume-delete APIs and final state; join backup/attachment inventory to assess consequences.","providers":[{"name":"AWS CloudTrail","scope":"Management-plane API activity; supported resource/data events require separate selectors.","source_id":"cloudtrail"},{"name":"Azure Monitor Activity Log","scope":"Azure resource control-plane operations; resource data-plane logs are separate.","source_id":"azure"},{"name":"Google Cloud Audit Logs","scope":"Admin Activity and other categories; configure Data Access where required.","source_id":"gcp"}],"configuration":["In the isolated account/project/subscription, route administrative audit logs to a protected destination with retention and access controls.","Select the relevant service, regions and read/write operations. Confirm whether the API below is a management or data event in the provider documentation.","Preserve actor/session, resource, request ID, service, operation, region and error details. Check delivery latency and avoid logging credentials or sensitive request bodies."],"configuration_example":null,"required_fields":["volume_id","action","actor","result"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0098","collector":"illustrative-lab-collector","observation":{"volume_id":"vol-lab-1","action":"delete","actor":"lab-admin","result":"requested"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"AWS, Azure and Google expose different APIs and event schemas. An accepted API request does not prove the final resource state; join asynchronous outcomes and inventory.","sources":[{"id":"cloudtrail","title":"AWS CloudTrail event categories","url":"https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-events.html"},{"id":"ec2","title":"AWS EC2 API logging with CloudTrail","url":"https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/monitor-with-cloudtrail.html"},{"id":"azure","title":"Azure Monitor Activity Log","url":"https://learn.microsoft.com/en-us/azure/azure-monitor/fundamentals/activity-log"},{"id":"gcp","title":"Google Cloud Audit Logs","url":"https://docs.cloud.google.com/logging/docs/audit"}],"association":"attack_component","anomaly_design":"Per account, role, region and API: rare actions, new role-resource relationships, enumeration bursts and configuration changes. Separate deployment automation and organization-level administrative activity."},{"id":"DC0092","name":"Volume Modification","page":"telemetry/DC0092/","kind":"attack_component","category":"Cloud control plane","description":"Changes to a cloud block-storage volume or its attachment configuration.","collection_focus":"Collect volume modify/attach/detach APIs plus resulting size, encryption and attachment state.","providers":[{"name":"AWS CloudTrail","scope":"Management-plane API activity; supported resource/data events require separate selectors.","source_id":"cloudtrail"},{"name":"Azure Monitor Activity Log","scope":"Azure resource control-plane operations; resource data-plane logs are separate.","source_id":"azure"},{"name":"Google Cloud Audit Logs","scope":"Admin Activity and other categories; configure Data Access where required.","source_id":"gcp"}],"configuration":["In the isolated account/project/subscription, route administrative audit logs to a protected destination with retention and access controls.","Select the relevant service, regions and read/write operations. Confirm whether the API below is a management or data event in the provider documentation.","Preserve actor/session, resource, request ID, service, operation, region and error details. Check delivery latency and avoid logging credentials or sensitive request bodies."],"configuration_example":null,"required_fields":["volume_id","attribute","before","after"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0092","collector":"illustrative-lab-collector","observation":{"volume_id":"vol-lab-1","attribute":"size_gib","before":8,"after":10}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"AWS, Azure and Google expose different APIs and event schemas. An accepted API request does not prove the final resource state; join asynchronous outcomes and inventory.","sources":[{"id":"cloudtrail","title":"AWS CloudTrail event categories","url":"https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-events.html"},{"id":"ec2","title":"AWS EC2 API logging with CloudTrail","url":"https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/monitor-with-cloudtrail.html"},{"id":"azure","title":"Azure Monitor Activity Log","url":"https://learn.microsoft.com/en-us/azure/azure-monitor/fundamentals/activity-log"},{"id":"gcp","title":"Google Cloud Audit Logs","url":"https://docs.cloud.google.com/logging/docs/audit"}],"association":"attack_component","anomaly_design":"Per account, role, region and API: rare actions, new role-resource relationships, enumeration bursts and configuration changes. Separate deployment automation and organization-level administrative activity."}],"detection":{"key":"enterprise/T1578","id":"T1578","name":"Modify Cloud Compute Infrastructure","domain":"enterprise","platforms":["IaaS"],"environments":["cloud"],"source_url":"https://attack.mitre.org/techniques/T1578","technique_page":"techniques/enterprise/T1578/","page":"detections/enterprise/T1578/","status":"rule_source_available","counts":{"sigma":1,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"sigma_rules":[{"id":"288a39fc-4914-4831-9ada-270e9dc12cb4","title":"Azure Active Directory Hybrid Health AD FS New Server","status":"test","level":"medium","logsource":{"product":"azure","service":"activitylogs"},"data_path":"data/detection-rules/288a39fc-4914-4831-9ada-270e9dc12cb4.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/cloud/azure/activity_logs/azure_aadhybridhealth_adfs_new_server.yml","author":"Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), MSTIC","kind":"sigma"}],"atlas_basic":[],"atlas_anomaly":[],"anomaly_types":[],"strategies":[{"id":"DET0308","name":"Detection Strategy for Modify Cloud Compute Infrastructure","url":"https://attack.mitre.org/detectionstrategies/DET0308","stix_id":"x-mitre-detection-strategy--af0d25b2-1912-4821-85db-305abe318535","relationship_id":"relationship--55386ce2-a1d3-426e-9e5a-37e52c20d18a","description":"","analytics":[{"id":"AN0861","name":"Analytic 0861","guidance":"Detection focuses on identifying unauthorized or anomalous changes to compute infrastructure components. Defender perspective: monitor for creation, deletion, or modification of instances, volumes, and snapshots outside of approved change management windows; correlate abnormal activity such as rapid snapshot creation followed by new instance mounts, or repeated infrastructure changes by rarely used accounts. Flagging activity linked to unusual geolocation, API client, or automation script is suspicious.","url":"https://attack.mitre.org/detectionstrategies/DET0308#AN0861","platforms":["IaaS"],"tuning":[{"field":"ChangeWindow","description":"Approved maintenance or deployment windows. Helps reduce false positives by distinguishing scheduled activity."},{"field":"UserContext","description":"IAM user, role, or service account performing the operation. Tunable to allowlist known automation services."},{"field":"RateThreshold","description":"Number of infrastructure changes (e.g., snapshot creations) in a defined period. Adjusted based on workload scale."},{"field":"GeoLocation","description":"Region or source IP where changes originate. Useful for tuning alerts to account for multi-region deployments."}],"log_sources":[{"component_id":"DC0080","component":"Instance Start","name":"AWS:CloudTrail","channel":"RunInstances","platforms":["IaaS"],"analytic_id":"AN0861","source_url":"https://attack.mitre.org/detectionstrategies/DET0308#AN0861","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0080/"},{"component_id":"DC0089","component":"Instance Stop","name":"AWS:CloudTrail","channel":"TerminateInstances","platforms":["IaaS"],"analytic_id":"AN0861","source_url":"https://attack.mitre.org/detectionstrategies/DET0308#AN0861","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0089/"},{"component_id":"DC0092","component":"Volume Modification","name":"AWS:CloudTrail","channel":"ModifyVolume","platforms":["IaaS"],"analytic_id":"AN0861","source_url":"https://attack.mitre.org/detectionstrategies/DET0308#AN0861","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0092/"},{"component_id":"DC0098","component":"Volume Deletion","name":"AWS:CloudTrail","channel":"DeleteVolume, ModifyVolume","platforms":["IaaS"],"analytic_id":"AN0861","source_url":"https://attack.mitre.org/detectionstrategies/DET0308#AN0861","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0098/"},{"component_id":"DC0097","component":"Volume Creation","name":"AWS:CloudTrail","channel":"CreateVolume","platforms":["IaaS"],"analytic_id":"AN0861","source_url":"https://attack.mitre.org/detectionstrategies/DET0308#AN0861","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0097/"},{"component_id":"DC0057","component":"Snapshot Creation","name":"AWS:CloudTrail","channel":"CreateSnapshot","platforms":["IaaS"],"analytic_id":"AN0861","source_url":"https://attack.mitre.org/detectionstrategies/DET0308#AN0861","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0057/"},{"component_id":"DC0049","component":"Snapshot Deletion","name":"AWS:CloudTrail","channel":"DeleteSnapshot","platforms":["IaaS"],"analytic_id":"AN0861","source_url":"https://attack.mitre.org/detectionstrategies/DET0308#AN0861","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0049/"},{"component_id":"DC0058","component":"Snapshot Modification","name":"AWS:CloudTrail","channel":"ModifySnapshotAttribute","platforms":["IaaS"],"analytic_id":"AN0861","source_url":"https://attack.mitre.org/detectionstrategies/DET0308#AN0861","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0058/"},{"component_id":"DC0070","component":"Cloud Service Metadata","name":"AWS:CloudWatch","channel":"unexpected IAM user or role assuming privileges for instance/snapshot operations","platforms":["IaaS"],"analytic_id":"AN0861","source_url":"https://attack.mitre.org/detectionstrategies/DET0308#AN0861","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0070/"}]}]}],"telemetry_references":[{"id":"DC0070","name":"Cloud Service Metadata","tag":"Cloud Service Metadata","page":"telemetry/DC0070/","kind":"attack_component"},{"id":"DC0080","name":"Instance Start","tag":"Instance Start","page":"telemetry/DC0080/","kind":"attack_component"},{"id":"DC0089","name":"Instance Stop","tag":"Instance Stop","page":"telemetry/DC0089/","kind":"attack_component"},{"id":"DC0057","name":"Snapshot Creation","tag":"Snapshot Creation","page":"telemetry/DC0057/","kind":"attack_component"},{"id":"DC0049","name":"Snapshot Deletion","tag":"Snapshot Deletion","page":"telemetry/DC0049/","kind":"attack_component"},{"id":"DC0058","name":"Snapshot Modification","tag":"Snapshot Modification","page":"telemetry/DC0058/","kind":"attack_component"},{"id":"DC0097","name":"Volume Creation","tag":"Volume Creation","page":"telemetry/DC0097/","kind":"attack_component"},{"id":"DC0098","name":"Volume Deletion","tag":"Volume Deletion","page":"telemetry/DC0098/","kind":"attack_component"},{"id":"DC0092","name":"Volume Modification","tag":"Volume Modification","page":"telemetry/DC0092/","kind":"attack_component"}],"visibility":"source_mapped","visibility_note":null,"tool_references":[],"related_parent":null,"article_url":"https://1200km.com/articles/read/2026/2026-04-20-malicious-activity-as-a-statistical-signal-a-detection-engineering-analysis-of-anomaly-bas-90df8b6dea12/","validation":{"source_join":"exact_ids","sigma_yaml":"parsed","backend_compilation":"not_run","live_telemetry":"not_run","detection_execution":"not_run"}},"tools":[],"software":[],"actors":[],"mitigations":[{"id":"M1018","name":"User Account Management","url":"https://attack.mitre.org/mitigations/M1018","kind":"course-of-action","description":"Limit permissions for creating, deleting, and otherwise altering compute components in accordance with least privilege. Organizations should limit the number of users within the organization with an IAM role that has administrative privileges, strive to reduce all permanent privileged role assignments, and conduct periodic entitlement reviews on IAM users, roles and policies.(Citation: Mandiant M-Trends 2020)","relationship_id":"relationship--0b74039a-c985-4587-bed7-0876f2ef1e6c","references":[{"source_name":"Mandiant M-Trends 2020","description":"Mandiant. (2020, February). M-Trends 2020. Retrieved November 17, 2024.","url":"https://www.mandiant.com/sites/default/files/2021-09/mtrends-2020.pdf"}]},{"id":"M1047","name":"Audit","url":"https://attack.mitre.org/mitigations/M1047","kind":"course-of-action","description":"Routinely monitor user permissions to ensure only the expected users have the capability to modify cloud compute infrastructure components.","relationship_id":"relationship--91c4630e-772b-4dac-8e58-5a899ccdc2be","references":[]}],"candidates":[],"simulation":{"atomic_status":"no_atomic_candidate","lab_execution":"not_run","browser_attack_runner":false,"prerequisites":"Use disposable lab hosts and test accounts, explicit target allowlists, a clean snapshot, bounded egress and a restore plan. Review every candidate and dependency before any execution.","scenario":null},"validation":{"source_identity":"checked_against_pinned_source","relationship_join":"exact_ids_no_inheritance","page_contract":"automated_checks_required","sensor_capture":"not_run","detection_backend":"not_run","adversary_simulation":"not_run","independent_incident_fact_check":"not_performed"},"technique_links":{"T1578":"/ttp-simulation/techniques/enterprise/T1578/"},"synthetic":{"schema":"1200km.ttp.collection-fixture.v1","synthetic":true,"technique_key":"enterprise/T1578","purpose":"Collection/parser contract exercise, NOT a positive example or detection of this TTP.","events":[{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0070","collector":"illustrative-lab-collector","observation":{"resource_id":"lab-service-1","service":"lab-audit-service","enabled":true,"retention_days":30}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0080","collector":"illustrative-lab-collector","observation":{"instance_id":"vm-lab-1","action":"start","state_before":"stopped","state_after":"pending"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0089","collector":"illustrative-lab-collector","observation":{"instance_id":"vm-lab-1","action":"stop","state_before":"running","state_after":"stopping"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0057","collector":"illustrative-lab-collector","observation":{"snapshot_id":"snap-lab-1","source_volume":"vol-lab-1","action":"create","state":"pending"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0049","collector":"illustrative-lab-collector","observation":{"snapshot_id":"snap-lab-1","action":"delete","actor":"lab-admin","result":"requested"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0058","collector":"illustrative-lab-collector","observation":{"snapshot_id":"snap-lab-1","attribute":"shared_with","before":[],"after":["lab-account-2"]}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0097","collector":"illustrative-lab-collector","observation":{"volume_id":"vol-lab-1","action":"create","size_gib":8,"encrypted":true}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0098","collector":"illustrative-lab-collector","observation":{"volume_id":"vol-lab-1","action":"delete","actor":"lab-admin","result":"requested"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0092","collector":"illustrative-lab-collector","observation":{"volume_id":"vol-lab-1","attribute":"size_gib","before":8,"after":10}}]}}