Modify Cloud Compute Infrastructure
- ID
- T1578
- Tactics
- TA0112 Defense Impairment
- Platforms
- IaaS
- Data sources
- Instance Start, Instance Stop, Volume Modification, Volume Deletion, Volume Creation, Snapshot Creation, Snapshot Deletion, Snapshot Modification, Cloud Service Metadata
- Source
- attack.mitre.org
- MITRE last modified
- 12 May 2026
An adversary may attempt to modify a cloud account's compute service infrastructure to evade defenses. A modification to the compute service infrastructure can include the creation, deletion, or modification of one or more components such as compute instances, virtual machines, and snapshots.
Permissions gained from the modification of infrastructure components may bypass restrictions that prevent access to existing infrastructure. Modifying infrastructure components may also allow an adversary to evade detection and remove evidence of their presence.[1]
Sub-techniques (5)
- T1578.001 Create Snapshot
- T1578.002 Create Cloud Instance
- T1578.003 Delete Cloud Instance
- T1578.004 Revert Cloud Instance
- T1578.005 Modify Cloud Compute Configurations
Detection
- DET0308 Detection Strategy for Modify Cloud Compute Infrastructure
Data components: Instance Start, Instance Stop, Volume Modification, Volume Deletion, Volume Creation, Snapshot Creation, Snapshot Deletion, Snapshot Modification, Cloud Service Metadata
Mitigations (2)
- M1018 User Account Management
Limit permissions for creating, deleting, and otherwise altering compute components in accordance with least privilege. Organizations should limit the number of users within the organization with an IAM role that has administrative privileges, strive to reduce all permanent privileged role assignments, and conduct periodic entitlement reviews on IAM users, roles and policies.[1]
- M1047 Audit
Routinely monitor user permissions to ensure only the expected users have the capability to modify cloud compute infrastructure components.