Techniques › T1578.003 › AN0234
AN0234 Analytic 0234
IaaS · attack.mitre.org · ATT&CK Enterprise v19.2
<p>Defenders can detect suspicious cloud instance deletions by correlating events across authentication, instance lifecycle, and account activity. From a defender’s perspective, behaviors of interest include instances deleted shortly after creation, deletions initiated by new or rarely used accounts, deletions following snapshot creation, and deletions originating from anomalous geolocations or access keys. These may indicate adversarial attempts to destroy forensic evidence or evade detection.</p>
- Detects
- T1578.003 Delete Cloud Instance
- Part of
- DET0084 Detection Strategy for Modify Cloud Compute Infrastructure: Delete Cloud Instance
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| AWS:CloudTrail | TerminateInstances | DC0089 Instance Stop |
| AWS:CloudTrail | DescribeInstances | DC0086 Instance Metadata |
| azure:activity | MICROSOFT.COMPUTE/VIRTUALMACHINES/DELETE | DC0081 Instance Deletion |
Mutable elements
Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.
| Field | Description |
|---|---|
UserContext | Identity of the user/service account performing deletions; tuned to exclude automation or known administrative workflows. |
TimeWindow | Threshold for detecting rapid instance lifecycle events (e.g., creation and deletion within minutes). |
GeoLocation | Region or source IP where the delete request originated; can be tuned to align with enterprise cloud geography. |
RateThreshold | Number of deletions per user/account in a defined window; tuned for organizations with high elasticity. |