Modify Cloud Compute Infrastructure

An adversary may attempt to modify a cloud account's compute service infrastructure to evade defenses. A modification to the compute service infrastructure can include the creation, deletion, or modification of one or more components such as compute instances, virtual machines, and snapshots.

Permissions gained from the modification of infrastructure components may bypass restrictions that prevent access to existing infrastructure. Modifying infrastructure components may also allow an adversary to evade detection and remove evidence of their presence.[1]

ID: T1578
Sub-techniques:  T1578.001, T1578.002, T1578.003, T1578.004
Tactic: Defense Evasion
Platforms: AWS, Azure, GCP
Permissions Required: User
Data Sources: AWS CloudTrail logs, Azure activity logs, GCP audit logs, Stackdriver logs
Version: 1.0
Created: 30 August 2019
Last Modified: 14 September 2020


Mitigation Description

Routinely monitor user permissions to ensure only the expected users have the capability to modify cloud compute infrastructure components.

User Account Management

Limit permissions for creating, deleting, and otherwise altering compute components in accordance with least privilege. Organizations should limit the number of users within the organization with an IAM role that has administrative privileges, strive to reduce all permanent privileged role assignments, and conduct periodic entitlement reviews on IAM users, roles and policies.[1]


Establish centralized logging for the activity of cloud compute infrastructure components. Monitor for suspicious sequences of events, such as the creation of multiple snapshots within a short period of time or the mount of a snapshot to a new instance by a new or unexpected user. To reduce false positives, valid change management procedures could introduce a known identifier that is logged with the change (e.g., tag or header) if supported by the cloud provider, to help distinguish valid, expected actions from malicious ones.