Modify Cloud Resource Hierarchy T1666

Tactic: Defense Impairment

Adversaries may attempt to modify hierarchical structures in infrastructure-as-a-service (IaaS) environments in order to evade defenses.

Authoring guide

These 1 rule share fields, values, and exclusions.

Fields filtered most (1 distinct)

These fields appear most often in rule filters.

FieldRulesHowSample values
aws::eventName1eq 1LeaveOrganization

Top indicator values (1 distinct)

These values appear most often in rule predicates.

FieldKindValueRules (here)Corpus reach
aws::eventNameeq
LeaveOrganization
1

Rules under this technique

These vendors publish rules tagged with this technique.

Platform: AWS

Domain: Cloud

Panther 1 rule