Modify Cloud Compute Infrastructure `T1578`

Tactic: Defense Impairment

An adversary may attempt to modify a cloud account's compute service infrastructure to evade defenses. A modification to the compute service infrastructure can include the creation, deletion, or modification of one or more components such as compute instances, virtual machines, and snapshots.

Authoring guide

These 37 rules share fields, values, and exclusions.

Fields filtered most (34 distinct)

These fields appear most often in rule filters.

Field	Rules	How	Sample values
`event.outcome`	21	`eq` 21	`success`, `Success`
`EventType`	20	`in` 8, `eq` 7, `starts_with` 6, `wildcard` 2	`AddPermission`, `AddLayerVersionPermission`, `AuthorizeSecurityGroupEgress`, `AuthorizeSecurityGroupIngress`, `CreateDBClusterSnapshot`
`data_stream.dataset`	20	`eq` 20	`aws.cloudtrail`, `gcp.audit`, `azure.activitylogs`
`Provider_Name`	16	`eq` 16	`ec2.amazonaws.com`, `lambda.amazonaws.com`, `rds.amazonaws.com`
`azure_ad::operation_name_value`	7	`eq` 5, `in` 2	`Microsoft.ADHybridHealthService/services/servicemembers/action`, `Microsoft.ADHybridHealthService/services/delete`, `microsoft.compute/virtualmachines/write`, `microsoft.resources/deployments/write`
`aws::requestParameters`	6	`contains` 6	`lambda:InvokeFunction`, `userData=`, `attributeType=CREATE_VOLUME_PERMISSION`, `authType=NONE`, `deletionProtection=false`
`CategoryValue`	5	`eq` 5	`Administrative`
`ResourceProviderValue`	5	`eq` 5	`Microsoft.ADHybridHealthService`
`OperationName`	3	`eq` 3	`Library.AgentPoolCreated`, `Library.VariableGroupModified`, `Release.ReleasePipelineModified`
`_ResourceId`	3	`contains` 3	`AdFederationService`
`ActivityStatusValue`	2	`starts_with` 2	`Accept`
`All_Changes.action`	2	`eq` 2	`created`, `deleted`, `modified`
`Properties`	2	`contains` 2	`vmSize`
`ResourceId`	2	`contains` 2	`AdFederationService`
`azure.activitylogs.operation_name`	2	`eq` 1, `starts_with` 1	`MICROSOFT.COMPUTE/VIRTUALMACHINES/EXTENSIONS/WRITE`, `MICROSOFT.KEYVAULT/VAULTS/*`

Top indicator values (134 distinct)

These values appear most often in rule predicates.

Field	Kind	Value	Rules (here)	Corpus reach
`event.outcome`	`eq`	`Success` elasticAWS EC2 Encryption Disabled elasticAWS EC2 Network Access Control List Creation elasticAWS EC2 Route Table Created elasticAWS EC2 Route Table Modified or Deleted elasticAWS EC2 Security Group Configuration Change elasticAWS EC2 Serial Console Access Enabled elasticAWS Lambda Event Source Mapping Creation elasticAWS Lambda Layer Added to Existing Function elasticAWS Lambda Layer Shared Externally elasticAWS RDS DB Instance Restored elasticAWS RDS DB Snapshot Created elasticAzure Key Vault Modified elasticAzure VM Extension Deployment by User elasticGCP Storage Bucket Configuration Modification elasticGCP Virtual Private Cloud Route Deletion	15	306
`event.outcome`	`eq`	`success` elasticAWS EC2 EBS Snapshot Access Removed elasticAWS EC2 Stop, Start, and User Data Modification Correlation elasticAWS Lambda Function Policy Updated to Allow Cross-Account Invocation elasticAWS Lambda Function Policy Updated to Allow Public Invocation elasticAWS Lambda Function URL Created with Public Access elasticAWS RDS DB Instance or Cluster Deletion Protection Disabled	6	82
`data_stream.dataset`	`eq`	`aws.cloudtrail` elasticAWS EC2 Encryption Disabled elasticAWS EC2 Network Access Control List Creation elasticAWS EC2 Route Table Created elasticAWS EC2 Route Table Modified or Deleted elasticAWS EC2 Security Group Configuration Change elasticAWS EC2 Serial Console Access Enabled elasticAWS Lambda Event Source Mapping Creation elasticAWS Lambda Layer Added to Existing Function elasticAWS Lambda Layer Shared Externally elasticAWS RDS DB Instance Restored	10	143
`data_stream.dataset`	`eq`	`aws.cloudtrail` elasticAWS EC2 EBS Snapshot Access Removed elasticAWS Lambda Function Policy Updated to Allow Cross-Account Invocation elasticAWS Lambda Function Policy Updated to Allow Public Invocation elasticAWS Lambda Function URL Created with Public Access elasticAWS RDS DB Instance or Cluster Deletion Protection Disabled	5	40
`data_stream.dataset`	`eq`	`gcp.audit` elasticGCP Storage Bucket Configuration Modification elasticGCP Virtual Private Cloud Route Creation elasticGCP Virtual Private Cloud Route Deletion	3	60
`data_stream.dataset`	`eq`	`azure.activitylogs` elasticAzure Key Vault Modified elasticAzure VM Extension Deployment by User	2	38
`Provider_Name`	`eq`	`ec2.amazonaws.com` elasticAWS EC2 Encryption Disabled elasticAWS EC2 Network Access Control List Creation elasticAWS EC2 Route Table Created elasticAWS EC2 Route Table Modified or Deleted elasticAWS EC2 Security Group Configuration Change elasticAWS EC2 Serial Console Access Enabled	6	18
`Provider_Name`	`eq`	`lambda.amazonaws.com` elasticAWS Lambda Function Policy Updated to Allow Cross-Account Invocation elasticAWS Lambda Function Policy Updated to Allow Public Invocation elasticAWS Lambda Function URL Created with Public Access	3	5
`Provider_Name`	`eq`	`lambda.amazonaws.com` elasticAWS Lambda Event Source Mapping Creation elasticAWS Lambda Layer Added to Existing Function elasticAWS Lambda Layer Shared Externally	3	7
`Provider_Name`	`eq`	`rds.amazonaws.com` elasticAWS RDS DB Instance Restored elasticAWS RDS DB Snapshot Created	2	4
`CategoryValue`	`eq`	`Administrative` sigmaAzure Active Directory Hybrid Health AD FS New Server sigmaAzure Active Directory Hybrid Health AD FS Service Delete kustoMicrosoft Entra ID Hybrid Health AD FS New Server kustoMicrosoft Entra ID Hybrid Health AD FS Service Delete kustoNRT Microsoft Entra ID Hybrid Health AD FS New Server	5	6
`ResourceProviderValue`	`eq`	`Microsoft.ADHybridHealthService` sigmaAzure Active Directory Hybrid Health AD FS New Server sigmaAzure Active Directory Hybrid Health AD FS Service Delete kustoMicrosoft Entra ID Hybrid Health AD FS New Server kustoMicrosoft Entra ID Hybrid Health AD FS Service Delete kustoNRT Microsoft Entra ID Hybrid Health AD FS New Server	5	6
`_ResourceId`	`contains`	`AdFederationService` kustoMicrosoft Entra ID Hybrid Health AD FS New Server kustoMicrosoft Entra ID Hybrid Health AD FS Service Delete kustoNRT Microsoft Entra ID Hybrid Health AD FS New Server	3	4
`azure_ad::operation_name_value`	`eq`	`Microsoft.ADHybridHealthService/services/servicemembers/action` sigmaAzure Active Directory Hybrid Health AD FS New Server kustoMicrosoft Entra ID Hybrid Health AD FS New Server kustoNRT Microsoft Entra ID Hybrid Health AD FS New Server	3	3
`azure_ad::operation_name_value`	`eq`	`Microsoft.ADHybridHealthService/services/delete` sigmaAzure Active Directory Hybrid Health AD FS Service Delete kustoMicrosoft Entra ID Hybrid Health AD FS Service Delete	2	2
`ActivityStatusValue`	`starts_with`	`Accept` kustoCreation of expensive computes in Azure kustoNRT Creation of expensive computes in Azure	2	2
`All_Changes.action`	`eq`	`created` splunkCloud Compute Instance Created With Previously Unseen Instance Type splunkCloud Security Groups Modifications by User	2	11
`All_Changes.action`	`eq`	`deleted` splunkCloud Security Groups Modifications by User	1
`All_Changes.action`	`eq`	`modified` splunkCloud Security Groups Modifications by User	1	3
`EventType`	`starts_with`	`AddPermission*` elasticAWS Lambda Function Policy Updated to Allow Cross-Account Invocation elasticAWS Lambda Function Policy Updated to Allow Public Invocation	2	2
`Properties`	`contains`	`vmSize` kustoCreation of expensive computes in Azure kustoNRT Creation of expensive computes in Azure	2	2
`ResourceId`	`contains`	`AdFederationService` sigmaAzure Active Directory Hybrid Health AD FS New Server sigmaAzure Active Directory Hybrid Health AD FS Service Delete	2	2
`aws::requestParameters`	`contains`	`lambda:InvokeFunction` elasticAWS Lambda Function Policy Updated to Allow Cross-Account Invocation elasticAWS Lambda Function Policy Updated to Allow Public Invocation	2	2
`azure_ad::operation_name_value`	`in`	`microsoft.compute/virtualmachines/write` kustoCreation of expensive computes in Azure kustoNRT Creation of expensive computes in Azure	2	4
`azure_ad::operation_name_value`	`in`	`microsoft.resources/deployments/write` kustoCreation of expensive computes in Azure kustoNRT Creation of expensive computes in Azure	2	4
`All_Changes.object_category`	`eq`	`security_group` splunkCloud Security Groups Modifications by User	1
`AnomalyType`	`gt`	`0` kustoCommvault Cloud Alert	1
`AnomalyType`	`is_not_null`	kustoCommvault Cloud Alert	1
`Esql.event_action_unique_count`	`eq`	`3` elasticAWS EC2 Stop, Start, and User Data Modification Correlation	1
`EventType`	`eq`	`ModifyInstanceAttribute` elasticAWS EC2 Stop, Start, and User Data Modification Correlation	1

Exclusions (32 distinct)

These values appear most often in top-level exclusions.

Field	Kind	Value	Rules excluding
`aws::userAgent`	`contains`	`Terraform` elasticAWS EC2 EBS Snapshot Access Removed elasticAWS EC2 Encryption Disabled elasticAWS EC2 Network Access Control List Creation elasticAWS EC2 Route Table Created elasticAWS EC2 Security Group Configuration Change elasticAWS EC2 Stop, Start, and User Data Modification Correlation elasticAWS Lambda Function Policy Updated to Allow Public Invocation elasticAWS Lambda Function URL Created with Public Access elasticAWS Lambda Layer Added to Existing Function elasticAWS RDS DB Instance or Cluster Deletion Protection Disabled elasticAWS RDS DB Snapshot Created	11
`aws::userAgent`	`contains`	`Pulumi` elasticAWS EC2 EBS Snapshot Access Removed elasticAWS EC2 Network Access Control List Creation elasticAWS EC2 Route Table Created elasticAWS EC2 Security Group Configuration Change elasticAWS EC2 Stop, Start, and User Data Modification Correlation elasticAWS Lambda Function Policy Updated to Allow Public Invocation elasticAWS Lambda Function URL Created with Public Access elasticAWS Lambda Layer Added to Existing Function elasticAWS RDS DB Instance or Cluster Deletion Protection Disabled elasticAWS RDS DB Snapshot Created	10
`aws::userAgent`	`contains`	`Ansible` elasticAWS EC2 Network Access Control List Creation elasticAWS EC2 Security Group Configuration Change elasticAWS EC2 Stop, Start, and User Data Modification Correlation elasticAWS Lambda Function URL Created with Public Access	4
`UserKey`	`eq`	`historical_data` kustoAzure DevOps Build Variable Modified by New User	1
`aws::requestParameters`	`contains`	`.amazonaws.com` elasticAWS Lambda Function Policy Updated to Allow Cross-Account Invocation	1
`aws::requestParameters`	`contains`	`principal=\*` elasticAWS Lambda Function Policy Updated to Allow Cross-Account Invocation	1
`aws::sourceIPAddress`	`ends_with`	`.amazonaws.com` pantherAWS Modify Cloud Compute Infrastructure	1
`aws::sourceIPAddress`	`eq`	`backup.amazonaws.com` elasticAWS EC2 EBS Snapshot Access Removed	1
`aws::sourceIPAddress`	`in`	`cloudformation.amazonaws.com` elasticAWS EC2 Stop, Start, and User Data Modification Correlation	1
`aws::sourceIPAddress`	`in`	`servicecatalog.amazonaws.com` elasticAWS EC2 Stop, Start, and User Data Modification Correlation	1
`aws::userIdentity.arn`	`contains`	`ansible` elasticAWS Lambda Function URL Created with Public Access	1
`aws::userIdentity.arn`	`contains`	`pulumi` elasticAWS Lambda Function URL Created with Public Access	1
`aws::userIdentity.arn`	`contains`	`terraform` elasticAWS Lambda Function URL Created with Public Access	1
`aws::userIdentity.type`	`eq`	`AWSService` pantherAWS Modify Cloud Compute Infrastructure	1
`resource`	`ne`	`pods` pantherKubernetes Pod Created in System Namespace	1

Modify Cloud Compute Infrastructure `T1578`

Authoring guide

Fields filtered most (34 distinct)

Top indicator values (134 distinct)

Exclusions (32 distinct)

Rules under this technique

Sigma 2 rules

Elastic 22 rules

Splunk 2 rules

Kusto 9 rules

Panther 2 rules

Modify Cloud Compute Infrastructure T1578

Authoring guide

Fields filtered most (34 distinct)

Top indicator values (134 distinct)

Exclusions (32 distinct)

Rules under this technique

Sigma 2 rules

Elastic 22 rules

Splunk 2 rules

Kusto 9 rules

Panther 2 rules

Modify Cloud Compute Infrastructure `T1578`