tfMITRE ATT&CK technique

Modify Cloud Compute Infrastructure T1578

Tactic: Defense Impairment
Platform: IaaS
Version: 2.0
Created: 30 August 2019
Last modified: 12 May 2026

Sub-techniques 54 rules across the family · 1 mapped directly to T1578 · 3 of 5 carry rules

.001Create Snapshot0 .002Create Cloud Instance1 .003Delete Cloud Instance1 .004Revert Cloud Instance0 .005Modify Cloud Compute Configurations1

An adversary may attempt to modify a cloud account's compute service infrastructure to evade defenses. A modification to the compute service infrastructure can include the creation, deletion, or modification of one or more components such as compute instances, virtual machines, and snapshots.

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groupsNone recorded

Threat groupsNone recorded · 29% of ATT&CK techniques have none either.

CampaignsNone recorded

CampaignsNone recorded · 54% of ATT&CK techniques have none either.

Tools & malwareNone recorded

Tools & malwareNone recorded · 29% of ATT&CK techniques have none either.

Detection rules42nd pct

Detection rules42nd percentile · 58% of ATT&CK techniques have more detection rules written.

Offense vs defense T1578

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

How it got here

Range

Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.

Campaigns · 0Sigma rules (cumulative) · 1Splunk ESCU (cumulative) · 0

first rule: 2021 Q3

Modify Cloud Compute Infrastructure detection strategy DET0308

MITRE names one behaviour worth catching for this technique and breaks it into 1 analytic, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Detection Strategy for Modify Cloud Compute Infrastructure

Enterprise

1 platform

AN0861 · IaaS

Detection focuses on identifying unauthorized or anomalous changes to compute infrastructure components. Defender perspective: monitor for creation, deletion, or modification of instances, volumes, and snapshots outside of approved change management windows; correlate abnormal activity such as rapid snapshot creation followed by new instance mounts, or repeated infrastructure changes by rarely used accounts. Flagging activity linked to unusual geolocation, API client, or automation script is suspicious.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Snapshot DeletionDC0049	AWS:CloudTrail	DeleteSnapshot
Snapshot CreationDC0057	AWS:CloudTrail	CreateSnapshot
Snapshot ModificationDC0058	AWS:CloudTrail	ModifySnapshotAttribute
Cloud Service MetadataDC0070	AWS:CloudWatch	unexpected IAM user or role assuming privileges for instance/snapshot operations
Instance StartDC0080	AWS:CloudTrail	RunInstances
Instance StopDC0089	AWS:CloudTrail	TerminateInstances
Volume ModificationDC0092	AWS:CloudTrail	ModifyVolume
Volume CreationDC0097	AWS:CloudTrail	CreateVolume
Volume DeletionDC0098	AWS:CloudTrail	DeleteVolume, ModifyVolume

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
ChangeWindow	Approved maintenance or deployment windows. Helps reduce false positives by distinguishing scheduled activity.
UserContext	IAM user, role, or service account performing the operation. Tunable to allowlist known automation services.
RateThreshold	Number of infrastructure changes (e.g., snapshot creations) in a defined period. Adjusted based on workload scale.
GeoLocation	Region or source IP where changes originate. Useful for tuning alerts to account for multi-region deployments.

Modify Cloud Compute Infrastructure detections T1578

1 rule is mapped to this technique. Parent techniques also include their sub-techniques’ rules. Click a slice or key entry to filter the table.

42nd pctamong all ATT&CK techniques for number of rules

Product

Severity

Library

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs