Modify Cloud Compute Infrastructure: Delete Cloud Instance T1578.003

Tactic: Defense Impairment

An adversary may delete a cloud instance after they have performed malicious activities in an attempt to evade detection and remove evidence of their presence. Deleting an instance or virtual machine can remove valuable forensic artifacts and other evidence of suspicious behavior if the instance is not recoverable.

Authoring guide

These 2 rules share fields, values, and exclusions.

Fields filtered most (5 distinct)

These fields appear most often in rule filters.

FieldRulesHowSample values
CategoryValue2eq 2administrative
ResourceProviderValue2eq 2microsoft.adhybridhealthservice
azure_ad::operation_name_value2eq 2microsoft.adhybridhealthservice/services/delete
ResourceId1contains 1adfederationservice
_ResourceId1contains 1adfederationservice

Top indicator values (5 distinct)

These values appear most often in rule predicates.

FieldKindValueRules (here)Corpus reach
CategoryValueeq
administrative
26
ResourceProviderValueeq
microsoft.adhybridhealthservice
26
azure_ad::operation_name_valueeq
microsoft.adhybridhealthservice/services/delete
22
ResourceIdcontains
adfederationservice
12
_ResourceIdcontains
adfederationservice
14

Rules under this technique

These vendors publish rules tagged with this technique.

Platform: Azure

Domain: Cloud

Sigma 1 rule

Kusto 1 rule