kevmap

Techniques › T1578 › AN0861

AN0861 Analytic 0861

IaaS · attack.mitre.org · ATT&CK Enterprise v19.2

<p>Detection focuses on identifying unauthorized or anomalous changes to compute infrastructure components. Defender perspective: monitor for creation, deletion, or modification of instances, volumes, and snapshots outside of approved change management windows; correlate abnormal activity such as rapid snapshot creation followed by new instance mounts, or repeated infrastructure changes by rarely used accounts. Flagging activity linked to unusual geolocation, API client, or automation script is suspicious.</p>
Detects
T1578 Modify Cloud Compute Infrastructure
Part of
DET0308 Detection Strategy for Modify Cloud Compute Infrastructure

Log sources and channels

Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.

Log sourceChannelData component
AWS:CloudTrailRunInstancesDC0080 Instance Start
AWS:CloudTrailTerminateInstancesDC0089 Instance Stop
AWS:CloudTrailModifyVolumeDC0092 Volume Modification
AWS:CloudTrailDeleteVolume, ModifyVolumeDC0098 Volume Deletion
AWS:CloudTrailCreateVolumeDC0097 Volume Creation
AWS:CloudTrailCreateSnapshotDC0057 Snapshot Creation
AWS:CloudTrailDeleteSnapshotDC0049 Snapshot Deletion
AWS:CloudTrailModifySnapshotAttributeDC0058 Snapshot Modification
AWS:CloudWatchunexpected IAM user or role assuming privileges for instance/snapshot operationsDC0070 Cloud Service Metadata

Mutable elements

Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.

FieldDescription
ChangeWindowApproved maintenance or deployment windows. Helps reduce false positives by distinguishing scheduled activity.
UserContextIAM user, role, or service account performing the operation. Tunable to allowlist known automation services.
RateThresholdNumber of infrastructure changes (e.g., snapshot creations) in a defined period. Adjusted based on workload scale.
GeoLocationRegion or source IP where changes originate. Useful for tuning alerts to account for multi-region deployments.