Instance

The creation of a new instance or VM is a common part of operations within many cloud environments. Events should then not be viewed in isolation, but as part of a chain of behavior that could lead to other activities. For example, the creation of an instance by a new user account or the unexpected creation of one or more snapshots followed by the creation of an instance may indicate suspicious activity.

In AWS, CloudTrail logs capture the creation of an instance in the RunInstances event, and in Azure the creation of a VM may be captured in Azure activity logs.^{[3] [4]} Google's Admin Activity audit logs within their Cloud Audit logs can be used to detect the usage of gcloud compute instances create to create a VM.^[5]

Analytic 1 - Operations performed by unexpected initiators, unusual resource names, frequent modifications

index="azure_activity_logs" (OperationName="Create or Update Virtual Machine" OR OperationName="Create or Update Virtual Machine Extension")| stats count by InitiatorName, Resource| where Resource LIKE "Microsoft.Compute/virtualMachines*" AND (Status!="Succeeded" OR InitiatorName!="expected_initiator")| sort by Time

Monitor for newly constructed instances that may attempt to take advantage of a weakness in an Internet-facing computer or program using software, data, or commands in order to cause unintended or unanticipated behavior.

The deletion of a new instance or virtual machine is a common part of operations within many cloud environments. Events should then not be viewed in isolation, but as part of a chain of behavior that could lead to other activities. For example, detecting a sequence of events such as the creation of an instance, mounting of a snapshot to that instance, and deletion of that instance by a new user account may indicate suspicious activity.

In AWS, CloudTrail logs capture the deletion of an instance in the TerminateInstances event, and in Azure the deletion of a VM may be captured in Azure activity logs.^{[3] [4]} Google's Admin Activity audit logs within their Cloud Audit logs can be used to detect the usage of gcloud compute instances delete to delete a VM.^[5]

Analytic 1 - Operations performed by unexpected initiators, unusual resource names, frequent deletions

index="azure_activity_logs" (OperationName="Delete Virtual Machine" OR OperationName="Delete Disk" OR OperationName="Delete Role Assignment")| stats count by InitiatorName, Resource| where Resource LIKE "Microsoft.Compute/virtualMachines*" AND (Status!="Succeeded" OR InitiatorName!="expected_initiator")| sort by Time

Periodically baseline instances to identify malicious modifications or additions.

Periodically baseline instances to identify malicious modifications or additions.

Periodically baseline instances to identify malicious modifications or additions.

Establish centralized logging of instance activity, which can be used to monitor and review system events even after reverting to a snapshot, rolling back changes, or changing persistence/type of storage. Monitor specifically for events related to snapshots and rollbacks and VM configuration changes, that are occurring outside of normal activity. To reduce false positives, valid change management procedures could introduce a known identifier that is logged with the change (e.g., tag or header) if supported by the cloud provider, to help distinguish valid, expected actions from malicious ones.

Establish centralized logging of instance activity, which can be used to monitor and review system events even after reverting to a snapshot, rolling back changes, or changing persistence/type of storage. Monitor specifically for events related to activation of instances that are occurring outside of normal activity/planned operations. To reduce false positives, valid change management procedures could introduce a known identifier that is logged with the change (e.g., tag or header) if supported by the cloud provider, to help distinguish valid, expected actions from malicious ones.

Monitor for the activation or invocation of an instance (ex: instance.start within GCP Audit Logs)

Establish centralized logging of instance activity, which can be used to monitor and review system events even after reverting to a snapshot, rolling back changes, or changing persistence/type of storage. Monitor specifically for events related to deactivation of instances that are occurring outside of planned operations. To reduce false positives, valid change management procedures could introduce a known identifier that is logged with the change (e.g., tag or header) if supported by the cloud provider, to help distinguish valid, expected actions from malicious ones.