Changes made to a cloud volume, including its settings and control data (ex: AWS modify-volume)
| Name | Channel |
|---|---|
| AWS:CloudTrail | ModifyVolume |
| kubernetes:apiserver | Pod spec with hostPath or privileged securityContext |
| ID | Name | Technique Detected |
|---|---|---|
| DET0219 | Detection Strategy for Escape to Host | T1611 |
| DET0308 | Detection Strategy for Modify Cloud Compute Infrastructure | T1578 |