Modify Cloud Compute Infrastructure: Revert Cloud Instance `T1578.004`

Tactic: Defense Impairment

An adversary may revert changes made to a cloud instance after they have performed malicious activities in attempt to evade detection and remove evidence of their presence. In highly virtualized environments, such as cloud-based infrastructure, this may be accomplished by restoring virtual machine (VM) or data storage snapshots through the cloud management dashboard or cloud APIs.

Authoring guide

These 1 rule share fields, values, and exclusions.

Fields filtered most (4 distinct)

These fields appear most often in rule filters.

Field	Rules	How	Sample values
`EventType`	1	`in` 1	`restoredbinstancefromdbsnapshot`, `restoredbinstancefroms3`
`Provider_Name`	1	`eq` 1	`rds.amazonaws.com`
`data_stream.dataset`	1	`eq` 1	`aws.cloudtrail`
`event.outcome`	1	`eq` 1	`success`

Top indicator values (5 distinct)

These values appear most often in rule predicates.

Field	Kind	Value	Rules (here)	Corpus reach
`EventType`	`in`	`restoredbinstancefromdbsnapshot` elasticAWS RDS DB Instance Restored	1
`EventType`	`in`	`restoredbinstancefroms3` elasticAWS RDS DB Instance Restored	1
`Provider_Name`	`eq`	`rds.amazonaws.com` elasticAWS RDS DB Instance Restored	1	9
`data_stream.dataset`	`eq`	`aws.cloudtrail` elasticAWS RDS DB Instance Restored	1	173
`event.outcome`	`eq`	`success` elasticAWS RDS DB Instance Restored	1	375

Rules under this technique

These vendors publish rules tagged with this technique.

Platform: AWS

Domain: Cloud

Elastic 1 rule