Matrices
Enterprise
Mobile
ICS
Tactics
Enterprise
Mobile
ICS
Techniques
Enterprise
Mobile
ICS
Defenses
Mitigations
Enterprise
Mobile
ICS
Assets
Detections
Detection Strategies
Analytics
Data Components
CTI
Groups
Software
Campaigns
Resources
Get Started
Learn More about ATT&CK
ATT&CK Advisory Council
ATT&CKcon
ATT&CK Data & Tools
FAQ
Engage with ATT&CK
Version History
Updates
Legal & Branding
Benefactors
Contribute
Blog
Search
ATT&CKcon 7.0 is coming October 27-28, 2026. Learn more about
ATT&CKcon 7.0
and
submit your proposal
.
Home
Data Components
Instance Metadata
Instance Metadata
Contextual data about an instance and activity around it such as name, type, or status
ID:
DC0086
Domains
: Enterprise
Version
: 2.0
Created
: 20 October 2021
Last Modified
: 12 November 2025
Log Sources
Name
Channel
AWS:CloudTrail
DescribeInstances
Detection Strategy
ID
Name
Technique Detected
DET0169
Detection Strategy for Cloud Infrastructure Discovery
T1580
DET0449
Detection Strategy for Modify Cloud Compute Infrastructure: Create Cloud Instance
T1578.002
DET0084
Detection Strategy for Modify Cloud Compute Infrastructure: Delete Cloud Instance
T1578.003
×
Core Objects:
All
Core ATT&CK Objects
All
None
Matrices
Tactics
Techniques
Sub-Techniques
Defenses:
All
Defenses
All
None
Mitigations
Assets
Detection Strategies
Analytics
Data Components
CTI:
All
CTI
All
None
Groups
Software
Campaigns
Reference:
All
Reference
All
None
Resources
Domains:
All
Domains
All
None
Enterprise
Mobile
ICS
Reset filters