Storm-0501G1053 ↗
Has conducted mass deletion of cloud data stores and resources from Azure subscriptions.1
tfMITRE ATT&CK sub-technique
Delete Cloud Instance T1578.003
sub-technique of T1578 Modify Cloud Compute Infrastructure
- Tactic
- Defense Impairment
- Platform
- IaaS
- Version
- 2.0
- Created
- 16 June 2020
- Last modified
- 12 May 2026
- Contributor
- Arun Seelagan, CISA
An adversary may delete a cloud instance after they have performed malicious activities in an attempt to evade detection and remove evidence of their presence. Deleting an instance or virtual machine can remove valuable forensic artifacts and other evidence of suspicious behavior if the instance is not recoverable.
ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact
2
Threat groups56th pct
Threat groups56th percentile · 56% of ATT&CK techniques have this many threat groups attributed or fewer.0
CampaignsNone recorded
CampaignsNone recorded · 54% of ATT&CK techniques have none either.0
Tools & malwareNone recorded
Tools & malwareNone recorded · 29% of ATT&CK techniques have none either.1
Detection rules42nd pct
Detection rules42nd percentile · 58% of ATT&CK techniques have more detection rules written.Delete Cloud Instance MITRE reference T1578.003
56th pctamong all ATT&CK techniques for number of groups
2 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.
LAPSUS$G1004 ↗
Has deleted the target's systems and resources in the cloud to trigger the organization's incident and crisis response process.1
All 2 groups for this technique
Offense vs defense T1578.003
Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.
How it got here
Range
Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.
Campaigns · 0Sigma rules (cumulative) · 1Splunk ESCU (cumulative) · 0
first rule: 2021 Q3Delete Cloud Instance detection strategy DET0084
MITRE names one behaviour worth catching for this technique and breaks it into 1 analytic, one per platform. Each carries the log sources it needs and the fields you tune per environment.
Detection Strategy for Modify Cloud Compute Infrastructure: Delete Cloud Instance
1 platform
AN0234 · IaaS
Defenders can detect suspicious cloud instance deletions by correlating events across authentication, instance lifecycle, and account activity. From a defender’s perspective, behaviors of interest include instances deleted shortly after creation, deletions initiated by new or rarely used accounts, deletions following snapshot creation, and deletions originating from anomalous geolocations or access keys. These may indicate adversarial attempts to destroy forensic evidence or evade detection.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Instance DeletionDC0081 | azure:activity | MICROSOFT.COMPUTE/VIRTUALMACHINES/DELETE |
| Instance MetadataDC0086 | AWS:CloudTrail | DescribeInstances |
| Instance StopDC0089 | AWS:CloudTrail | TerminateInstances |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| UserContext | Identity of the user/service account performing deletions; tuned to exclude automation or known administrative workflows. |
| TimeWindow | Threshold for detecting rapid instance lifecycle events (e.g., creation and deletion within minutes). |
| GeoLocation | Region or source IP where the delete request originated; can be tuned to align with enterprise cloud geography. |
| RateThreshold | Number of deletions per user/account in a defined window; tuned for organizations with high elasticity. |
AuditM1047
Routinely check user permissions to ensure only the expected users have the capability to delete new instances.
Limit permissions for deleting new instances in accordance with least privilege. Organizations should limit the number of users within the organization with an IAM role that has administrative privileges, strive to reduce all permanent privileged role assignments, and conduct periodic entitlement reviews on IAM users, roles and policies.