tfMITRE ATT&CK sub-technique

Revert Cloud Instance T1578.004

sub-technique of T1578 Modify Cloud Compute Infrastructure

Tactic: Defense Impairment
Platform: IaaS
Version: 2.0
Created: 16 June 2020
Last modified: 12 May 2026
Contributor: Netskope

An adversary may revert changes made to a cloud instance after they have performed malicious activities in attempt to evade detection and remove evidence of their presence. In highly virtualized environments, such as cloud-based infrastructure, this may be accomplished by restoring virtual machine (VM) or data storage snapshots through the cloud management dashboard or cloud APIs.

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groupsNone recorded

Threat groupsNone recorded · 29% of ATT&CK techniques have none either.

CampaignsNone recorded

CampaignsNone recorded · 54% of ATT&CK techniques have none either.

Tools & malwareNone recorded

Tools & malwareNone recorded · 29% of ATT&CK techniques have none either.

Detection rulesNone recorded

Detection rulesNone recorded · 33% of ATT&CK techniques have none either.

Offense vs defense T1578.004

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

Revert Cloud Instance detection strategy DET0337

MITRE names one behaviour worth catching for this technique and breaks it into 1 analytic, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Detection Strategy for Modify Cloud Compute Infrastructure: Revert Cloud Instance

Enterprise

1 platform

AN0953 · IaaS

Defenders can detect suspicious reversion of cloud compute instances by monitoring for unusual snapshot restores, rollback actions, or ephemeral storage resets that occur outside expected administrative workflows. From a defender’s perspective, relevant detection chains include: a snapshot restore triggered by a new or rarely used account, a sequence of snapshot creation immediately followed by a restore and instance start, or rollbacks performed from anomalous geographic or network locations. These patterns may indicate attempts to remove forensic evidence or re-establish a clean execution state for persistence.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Instance ModificationDC0073	AWS:CloudTrail	RevertSnapshot
Instance StartDC0080	AWS:CloudTrail	StartInstances
Instance StopDC0089	AWS:CloudTrail	StopInstances

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
UserContext	Identity of the user or service account performing rollback actions; tuned to exclude automation or approved workflows.
TimeWindow	Threshold for correlating snapshot creation followed by reversion within minutes; tuned to environment activity norms.
GeoLocation	Region or source IP where the revert request originated; tuned to align with enterprise cloud geography.
ChangeTags	Use of administrative tags or headers to distinguish legitimate restores from malicious activity.

Revert Cloud Instance detections T1578.004

No detection rules are mapped to this technique yet.

None recorded— 33% of ATT&CK techniques have none either

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs