Cross-source coverage

T1578 / ATT&CK

Modify Cloud Compute Infrastructure

29 rules across 5 sources.

From MITRE ATT&CK 19.2

An adversary may attempt to modify a cloud account's compute service infrastructure to evade defenses. A modification to the compute service infrastructure can include the creation, deletion, or modification of one or more components such as compute instances, virtual machines, and snapshots.

Permissions gained from the modification of infrastructure components may bypass restrictions that prevent access to existing infrastructure. Modifying infrastructure components may also allow an adversary to evade detection and remove evidence of their presence.

Platforms
IaaS
Telemetry
AWS:CloudTrailAWS:CloudWatch

How MITRE says to detect it DET0308

Detection Strategy for Modify Cloud Compute Infrastructure

IaaS Analytic 0861

Detection focuses on identifying unauthorized or anomalous changes to compute infrastructure components. Defender perspective: monitor for creation, deletion, or modification of instances, volumes, and snapshots outside of approved change management windows; correlate abnormal activity such as rapid snapshot creation followed by new instance mounts, or repeated infrastructure changes by rarely used accounts. Flagging activity linked to unusual geolocation, API client, or automation script is suspicious.

  • AWS:CloudTrail RunInstances
  • AWS:CloudTrail TerminateInstances
  • AWS:CloudTrail ModifyVolume
  • AWS:CloudTrail DeleteVolume, ModifyVolume
  • AWS:CloudTrail CreateVolume
  • AWS:CloudTrail CreateSnapshot
  • AWS:CloudTrail DeleteSnapshot
  • AWS:CloudTrail ModifySnapshotAttribute
  • AWS:CloudWatch unexpected IAM user or role assuming privileges for instance/snapshot operations

View on attack.mitre.org ↗

Sub-techniques with coverage

Counted in the 29 above — a rule tagged a sub-technique covers this technique too.

elastic/detection-rules

21 rules
Detection Severity Format
AWS EC2 Serial Console Access Enabled High Elastic TOML
AWS EC2 Stop, Start, and User Data Modification Correlation High Elastic TOML
AWS Lambda Function Policy Updated to Allow Cross-Account Invocation High Elastic TOML
AWS Lambda Function Policy Updated to Allow Public Invocation High Elastic TOML
AWS Lambda Function URL Created with Public Access High Elastic TOML
AWS EC2 EBS Snapshot Access Removed Medium Elastic TOML
AWS EC2 Encryption Disabled Medium Elastic TOML
AWS Lambda Layer Shared Externally Medium Elastic TOML
AWS RDS DB Instance or Cluster Deletion Protection Disabled Medium Elastic TOML
AWS RDS DB Instance Restored Medium Elastic TOML

+ 11 more from elastic/detection-rules → showing the 10 highest-severity

Bert-JanP/Hunting-Queries-Detection-Rules

2 rules
Detection Severity Format
Large Number of Virtual Machines started Undefined KQL
MITRE ATT&CK Mapping Undefined KQL

SigmaHQ/sigma

2 rules
Detection Severity Format
Azure Active Directory Hybrid Health AD FS New Server Medium Sigma
Azure Active Directory Hybrid Health AD FS Service Delete Medium Sigma

panther-labs/panther-analysis

2 rules
Detection Severity Format
AWS Modify Cloud Compute Infrastructure Medium Panther Python
Kubernetes Pod Created in System Namespace Medium Panther Python

splunk/security_content

2 rules
Detection Severity Format
Cloud Compute Instance Created With Previously Unseen Instance Type Undefined SPL
Cloud Security Groups Modifications by User Undefined SPL

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.