Modify Cloud Compute Infrastructure: Create Cloud Instance `T1578.002`

Tactic: Defense Impairment

An adversary may create a new instance or virtual machine (VM) within the compute service of a cloud account to evade defenses. Creating a new instance may allow an adversary to bypass firewall rules and permissions that exist on instances currently residing within an account. An adversary may Create Snapshot of one or more volumes in an account, create a new instance, mount the snapshots, and then apply a less restrictive security policy to collect Data from Local System or for Remote Data Staging.

Authoring guide

These 5 rules share fields, values, and exclusions.

Fields filtered most (16 distinct)

These fields appear most often in rule filters.

Field	Rules	How	Sample values
`data_stream.dataset`	2	`eq` 2	`aws.cloudtrail`, `azure.activitylogs`
`event.outcome`	2	`eq` 2	`success`
`All_Changes.action`	1	`eq` 1	`created`
`EventType`	1	`in` 1	`restoredbinstancefromdbsnapshot`, `restoredbinstancefroms3`
`OperationName`	1	`eq` 1	`library.agentpoolcreated`, `library.agentpooldeleted`
`PoolType`	1	`eq` 1	`Self Hosted`
`Provider_Name`	1	`eq` 1	`rds.amazonaws.com`
`azure.activitylogs.identity.authorization.evidence.principal_type`	1	`eq` 1	`user`
`azure.activitylogs.operation_name`	1	`eq` 1	`microsoft.compute/virtualmachines/extensions/write`
`azure.resource.id`	1	`contains` 1	`/dsc/`, `customscriptextension`, `microsoftmonitoringagent`
`enough_data`	1	`eq` 1	`1`
`firstTimeSeenInstanceType`	1	`is_null` 1
`instance_type`	1	`ne` 1	`unknown`
`namespace`	1	`in` 1	`gke-system`, `kube-node-lease`, `kube-public`
`subresource`	1	`is_null` 1

Top indicator values (25 distinct)

These values appear most often in rule predicates.

Field	Kind	Value	Rules (here)	Corpus reach
`event.outcome`	`eq`	`success` elasticAWS RDS DB Instance Restored elasticAzure VM Extension Deployment by User	2	375
`All_Changes.action`	`eq`	`created` splunkCloud Compute Instance Created With Previously Unseen Instance Type	1	11
`EventType`	`in`	`restoredbinstancefromdbsnapshot` elasticAWS RDS DB Instance Restored	1
`EventType`	`in`	`restoredbinstancefroms3` elasticAWS RDS DB Instance Restored	1
`OperationName`	`eq`	`library.agentpoolcreated` kustoAzure DevOps Agent Pool Created Then Deleted	1
`OperationName`	`eq`	`library.agentpooldeleted` kustoAzure DevOps Agent Pool Created Then Deleted	1
`PoolType`	`eq`	`Self Hosted` kustoAzure DevOps Agent Pool Created Then Deleted	1
`Provider_Name`	`eq`	`rds.amazonaws.com` elasticAWS RDS DB Instance Restored	1	9
`azure.activitylogs.identity.authorization.evidence.principal_type`	`eq`	`user` elasticAzure VM Extension Deployment by User	1	2
`azure.activitylogs.operation_name`	`eq`	`microsoft.compute/virtualmachines/extensions/write` elasticAzure VM Extension Deployment by User	1
`azure.resource.id`	`contains`	`/dsc/` elasticAzure VM Extension Deployment by User	1
`azure.resource.id`	`contains`	`customscriptextension` elasticAzure VM Extension Deployment by User	1
`azure.resource.id`	`contains`	`microsoftmonitoringagent` elasticAzure VM Extension Deployment by User	1
`azure.resource.id`	`contains`	`runcommandlinux` elasticAzure VM Extension Deployment by User	1
`azure.resource.id`	`contains`	`runcommandwindows` elasticAzure VM Extension Deployment by User	1
`azure.resource.id`	`contains`	`vmaccessagent` elasticAzure VM Extension Deployment by User	1
`data_stream.dataset`	`eq`	`aws.cloudtrail` elasticAWS RDS DB Instance Restored	1	173
`data_stream.dataset`	`eq`	`azure.activitylogs` elasticAzure VM Extension Deployment by User	1	39
`enough_data`	`eq`	`1` splunkCloud Compute Instance Created With Previously Unseen Instance Type	1	10
`instance_type`	`ne`	`unknown` splunkCloud Compute Instance Created With Previously Unseen Instance Type	1
`namespace`	`in`	`gke-system` pantherKubernetes Pod Created in System Namespace	1
`namespace`	`in`	`kube-node-lease` pantherKubernetes Pod Created in System Namespace	1
`namespace`	`in`	`kube-public` pantherKubernetes Pod Created in System Namespace	1
`namespace`	`in`	`kube-system` pantherKubernetes Pod Created in System Namespace	1
`username`	`contains`	`serviceaccount` pantherKubernetes Pod Created in System Namespace	1	24

Exclusions (8 distinct)

These values appear most often in top-level exclusions.

Field	Kind	Value	Rules excluding
`resource`	`ne`	`pods` pantherKubernetes Pod Created in System Namespace	1
`responseStatus.code`	`ge`	`1` pantherKubernetes Pod Created in System Namespace	1
`responseStatus.code`	`ge`	`400` pantherKubernetes Pod Created in System Namespace	1
`responseStatus.code`	`le`	`16` pantherKubernetes Pod Created in System Namespace	1
`username`	`in`	`aksService` pantherKubernetes Pod Created in System Namespace	1
`username`	`in`	`masterclient` pantherKubernetes Pod Created in System Namespace	1
`username`	`starts_with`	`system:` pantherKubernetes Pod Created in System Namespace	1
`verb`	`ne`	`create` pantherKubernetes Pod Created in System Namespace	1

Rules under this technique

These vendors publish rules tagged with this technique.

Elastic 2 rules

Modify Cloud Compute Infrastructure: Create Cloud Instance T1578.002