MITRE ATT&CKtechnique

T1578 Modify Cloud Compute Infrastructure

Published 2019-08-30 Modified 2026-05-12 Official page ↗
Domain
enterprise
Tactics
Defense Impairment
Platforms
IaaS
Version
2.0
Created
2019-08-30

Description

An adversary may attempt to modify a cloud account's compute service infrastructure to evade defenses. A modification to the compute service infrastructure can include the creation, deletion, or modification of one or more components such as compute instances, virtual machines, and snapshots. Permissions gained from the modification of infrastructure components may bypass restrictions that prevent access to existing infrastructure. Modifying infrastructure components may also allow an adversary to evade detection and remove evidence of their presence.

Related

Tactic · MITRE ATT&CK (1)

  • TA0112 Defense Impairment tactic

Referenced by MITRE ATT&CK · mitigates (2)

  • M1047 Audit mitigation
  • M1018 User Account Management mitigation

Referenced by MITRE ATT&CK · subtechnique of (5)

  • T1578.005 Modify Cloud Compute Configurations sub-technique
  • T1578.003 Delete Cloud Instance sub-technique
  • T1578.004 Revert Cloud Instance sub-technique
  • T1578.001 Create Snapshot sub-technique
  • T1578.002 Create Cloud Instance sub-technique

Referenced by Compliance · mitigates (13)

  • CIS-4.6 Securely Manage Enterprise Assets and Software CIS Safeguard v8.1
  • CIS-6.8 Define and Maintain Role-Based Access Control CIS Safeguard v8.1
  • NIST-AC-2 Account Management NIST 800-53 control
  • NIST-AC-3 Access Enforcement NIST 800-53 control
  • NIST-AC-5 Separation of Duties NIST 800-53 control
  • NIST-AC-6 Least Privilege NIST 800-53 control
  • NIST-CM-2 Baseline Configuration NIST 800-53 control
  • NIST-CM-5 Access Restrictions for Change NIST 800-53 control
  • NIST-IA-2 Identification and Authentication (Organizational Users) NIST 800-53 control
  • NIST-IA-4 Identifier Management NIST 800-53 control
  • NIST-IA-6 Authentication Feedback NIST 800-53 control
  • NIST-RA-5 Vulnerability Monitoring and Scanning NIST 800-53 control
  • NIST-SI-4 System Monitoring NIST 800-53 control

References