MITRE ATT&CKsub-technique

T1578.003 Delete Cloud Instance

Published 2020-06-16 Modified 2026-05-12 Official page ↗
Domain
enterprise
Tactics
Defense Impairment
Platforms
IaaS
Version
2.0
Created
2020-06-16

Description

An adversary may delete a cloud instance after they have performed malicious activities in an attempt to evade detection and remove evidence of their presence. Deleting an instance or virtual machine can remove valuable forensic artifacts and other evidence of suspicious behavior if the instance is not recoverable. An adversary may also Create Cloud Instance and later terminate the instance after achieving their objectives.

Related

Subtechnique of · MITRE ATT&CK (1)

  • T1578 Modify Cloud Compute Infrastructure technique

Tactic · MITRE ATT&CK (1)

  • TA0112 Defense Impairment tactic

Referenced by MITRE ATT&CK · mitigates (2)

  • M1047 Audit mitigation
  • M1018 User Account Management mitigation

Referenced by MITRE ATT&CK · uses (2)

Referenced by Compliance · mitigates (12)

  • CIS-6.8 Define and Maintain Role-Based Access Control CIS Safeguard v8.1
  • NIST-AC-2 Account Management NIST 800-53 control
  • NIST-AC-3 Access Enforcement NIST 800-53 control
  • NIST-AC-5 Separation of Duties NIST 800-53 control
  • NIST-AC-6 Least Privilege NIST 800-53 control
  • NIST-CM-2 Baseline Configuration NIST 800-53 control
  • NIST-CM-5 Access Restrictions for Change NIST 800-53 control
  • NIST-IA-2 Identification and Authentication (Organizational Users) NIST 800-53 control
  • NIST-IA-4 Identifier Management NIST 800-53 control
  • NIST-IA-6 Authentication Feedback NIST 800-53 control
  • NIST-RA-5 Vulnerability Monitoring and Scanning NIST 800-53 control
  • NIST-SI-4 System Monitoring NIST 800-53 control

References