tfMITRE ATT&CK sub-technique

Create Cloud Instance T1578.002

sub-technique of T1578 Modify Cloud Compute Infrastructure

Tactic: Defense Impairment
Platform: IaaS
Version: 2.0
Created: 14 May 2020
Last modified: 12 May 2026
Contributor: Arun Seelagan, CISA

An adversary may create a new instance or virtual machine (VM) within the compute service of a cloud account to evade defenses. Creating a new instance may allow an adversary to bypass firewall rules and permissions that exist on instances currently residing within an account. An adversary may Create Snapshot of one or more volumes in an account, create a new instance, mount the snapshots, and then apply a less restrictive security policy to collect Data from Local System or for Remote Data Staging.[1]

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groups56th pct

Threat groups56th percentile · 56% of ATT&CK techniques have this many threat groups attributed or fewer.

Campaigns72nd pct

Campaigns72nd percentile · 72% of ATT&CK techniques have this many campaigns recorded or fewer.

Tools & malwareNone recorded

Tools & malwareNone recorded · 29% of ATT&CK techniques have none either.

Detection rules42nd pct

Detection rules42nd percentile · 58% of ATT&CK techniques have more detection rules written.

Create Cloud Instance MITRE reference T1578.002

56th pctamong all ATT&CK techniques for number of groups

2 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.

Scattered SpiderG1015 ↗

Has created Amazon EC2 instances within the victim's environment.1

created 2023-07-051 referenceaka Roasted 0ktapus

LAPSUS$G1004 ↗

Has created new virtual machines within the target's cloud environment after leveraging credential access to cloud assets.1

created 2022-06-091 referenceaka DEV-0537

All 2 groups for this technique

Offense vs defense T1578.002

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

How it got here

Range

Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.

Campaigns · 1Sigma rules (cumulative) · 0Splunk ESCU (cumulative) · 1

first rule: 2019 Q4 · 1 of 1 campaigns plotted

Create Cloud Instance detection strategy DET0449

MITRE names one behaviour worth catching for this technique and breaks it into 1 analytic, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Detection Strategy for Modify Cloud Compute Infrastructure: Create Cloud Instance

Enterprise

1 platform

AN1242 · IaaS

Detection focuses on abnormal or unauthorized cloud instance creation events. From a defender’s perspective, suspicious behavior includes VM/instance creation by rarely used or newly created accounts, creation events from unusual geolocations, or rapid sequences of snapshot creation followed by instance creation and mounting. Unexpected network or IAM policy changes applied to new instances can indicate adversarial use rather than legitimate provisioning.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Instance CreationDC0076	azure:activity	MICROSOFT.COMPUTE/VIRTUALMACHINES/WRITE
Instance StartDC0080	AWS:CloudTrail	RunInstances
Instance MetadataDC0086	AWS:CloudTrail	DescribeInstances

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
UserContext	IAM user, service account, or role creating the instance. Tuned to allowlist known automation services.
GeoLocation	Region or source IP where the creation request originates. Helps detect cross-region or unusual location abuse.
RateThreshold	Number of instances created per user or account in a time window. Tuned for environments with elastic scaling.
TaggingPolicy	Expected tags (e.g., owner, purpose, cost center) for new instances. Deviations may indicate adversarial creation.

Tests2Executorssh 2Need elevation0 of 2Have prerequisites2Have cleanup2Platformsiaas:aws, linux

Test

Platform

Executor

Elevation

Prereqs

Cleanup

Ref

Create EC2 Instance from Launch Template

iaas:aws, linux

—

Yes

Creating and launching an instance using RunInstances, with a launch template. This launch template will contain all the necessary parameters for the instance. Reference for the launch templates https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/create-launch-template.html https://docs.aws.amazon.com/cli/latest/reference/ec2/run-instances.html#examples

Input arguments

Name	Type	Default	Description
ami_id	string	ami-12345678	AMI ID to use
version	string	1	Launch template version description
aws_region	string	us-east-1	AWS region
instance_id	string	i-1234567890abcdef0	EC2 instance ID to terminate
profile_name	string	default	AWS profile name
instance_type	string	tg4.nano	EC2 instance type
template_name	string	PathToAtomicsFolder/T1578.002/src/template.json	Full path to the template.json file

Attack command

aws ec2 create-launch-template \
  --launch-template-name #{template_name} \
  --version-description #{version} \
  --tag-specifications 'ResourceType=launch-template,Tags=[{Key=purpose,Value=production}]' \
  --launch-template-data file://template.json

aws ec2 run-instances --image-id #{ami_id} --instance-type #{instance_type} \
  --region #{aws_region} --profile #{profile_name}

Cleanup command

aws ec2 terminate-instances  --instance-ids #{instance_id} \
  --region  #{aws_region} --profile #{profile_name}

Prerequisite

AWS CLI must be installed

Check

if command -v aws > /dev/null 2>&1; then exit 0; else exit 1; fi

Satisfy

echo "Install AWS CLI: https://docs.aws.amazon.com/cli/latest/userguide/install-cliv2.html"

GUID451fd9f1-492f-4f18-b607-4cbd6852e1fd

Create EC2 Instance with user data

iaas:aws, linux

—

Yes

Creates an EC2 instance with a keypair while passing user data in a script. The script runs at launch.

Input arguments

Name	Type	Default	Description
ami_id	string	ami-12345678	AMI ID to use
aws_region	string	us-west-2	AWS region
instance_id	string	i-1234567890abcdef0	EC2 instance ID to terminate
profile_name	string	default	AWS profile name
instance_type	string	tg4.nano	EC2 instance type

Attack command

printf '%s\n' '#!/bin/bash' 'date -u > /var/tmp/userdata-ran.txt' > my_script.txt
aws ec2 run-instances \
  --image-id #{ami_id} \
  --instance-type #{instance_type} \
  --count 1 \
  --subnet-id subnet-XXXXXXXXXXXXXXX \
  --key-name MyKeyPair \
  --user-data file://my_script.txt

Cleanup command

aws ec2 terminate-instances --instance-ids #{instance_id} \
  --region  #{aws_region} --profile #{profile_name}

Prerequisite

AWS CLI must be installed

Check

# Description: AWS CLI must be installed.
if command -v aws > /dev/null 2>&1; then exit 0; else exit 1; fi

Satisfy

echo "Install AWS CLI: https://docs.aws.amazon.com/cli/latest/userguide/install-cliv2.html"

GUIDabacf049-3f72-4f81-aa34-28573068c3f0

Tests from Atomic Red Team (MIT licence) · technique definition

Create Cloud Instance detections T1578.002

1 rule is mapped to this technique. Parent techniques also include their sub-techniques’ rules. Click a slice or key entry to filter the table.

42nd pctamong all ATT&CK techniques for number of rules

Product

Severity

Library

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs