Modify Cloud Compute Infrastructure: Modify Cloud Compute Configurations `T1578.005`

Tactic: Defense Impairment

Adversaries may modify settings that directly affect the size, locations, and resources available to cloud compute infrastructure in order to evade defenses. These settings may include service quotas, subscription associations, tenant-wide policies, or other configurations that impact available compute. Such modifications may allow adversaries to abuse the victim’s compute resources to achieve their goals, potentially without affecting the execution of running instances and/or revealing their activities to the victim.

Authoring guide

These 19 rules share fields, values, and exclusions.

Fields filtered most (10 distinct)

These fields appear most often in rule filters.

Field	Rules	How	Sample values
`data_stream.dataset`	18	`eq` 18	`aws.cloudtrail`, `gcp.audit`, `azure.activitylogs`
`EventType`	17	`eq` 6, `starts_with` 6, `in` 5, `wildcard` 2	`AddPermission`, `AddLayerVersionPermission`, `CreateEventSourceMapping`, `CreateFunctionUrlConfig`, `ModifyDBCluster`
`event.outcome`	17	`eq` 17	`success`
`Provider_Name`	13	`eq` 13	`ec2.amazonaws.com`, `lambda.amazonaws.com`, `rds.amazonaws.com`
`aws::requestParameters`	5	`contains` 5	`lambda:invokefunction`, `attributetype=create_volume_permission`, `authtype=none`, `deletionprotection=false`, `principal=\*`
`All_Changes.action`	1	`eq` 1	`created`, `deleted`, `modified`
`All_Changes.object_category`	1	`eq` 1	`security_group`
`aws.cloudtrail.flattened.request_parameters.groupSet.items.groupId`	1	`is_not_null` 1
`azure.activitylogs.operation_name`	1	`starts_with` 1	`MICROSOFT.KEYVAULT/VAULTS/`
`isOutlier`	1	`eq` 1	`1`

Top indicator values (51 distinct)

These values appear most often in rule predicates.

Field	Kind	Value	Rules (here)	Corpus reach
`event.outcome`	`eq`	`success` elasticAWS EC2 EBS Snapshot Access Removed elasticAWS EC2 Encryption Disabled elasticAWS EC2 Network Access Control List Creation elasticAWS EC2 Route Table Created elasticAWS EC2 Route Table Modified or Deleted elasticAWS EC2 Security Group Configuration Change elasticAWS EC2 Serial Console Access Enabled elasticAWS Lambda Event Source Mapping Creation elasticAWS Lambda Function Policy Updated to Allow Cross-Account Invocation elasticAWS Lambda Function Policy Updated to Allow Public Invocation elasticAWS Lambda Function URL Created with Public Access elasticAWS Lambda Layer Added to Existing Function elasticAWS Lambda Layer Shared Externally elasticAWS RDS DB Instance or Cluster Deletion Protection Disabled elasticAzure Key Vault Modified +2 more rules	17	375
`data_stream.dataset`	`eq`	`aws.cloudtrail` elasticAWS EC2 EBS Snapshot Access Removed elasticAWS EC2 Encryption Disabled elasticAWS EC2 Network Access Control List Creation elasticAWS EC2 Route Table Created elasticAWS EC2 Route Table Modified or Deleted elasticAWS EC2 Security Group Configuration Change elasticAWS EC2 Serial Console Access Enabled elasticAWS Lambda Event Source Mapping Creation elasticAWS Lambda Function Policy Updated to Allow Cross-Account Invocation elasticAWS Lambda Function Policy Updated to Allow Public Invocation elasticAWS Lambda Function URL Created with Public Access elasticAWS Lambda Layer Added to Existing Function elasticAWS Lambda Layer Shared Externally elasticAWS RDS DB Instance or Cluster Deletion Protection Disabled	14	173
`data_stream.dataset`	`eq`	`gcp.audit` elasticGCP Storage Bucket Configuration Modification elasticGCP Virtual Private Cloud Route Creation elasticGCP Virtual Private Cloud Route Deletion	3	69
`Provider_Name`	`eq`	`ec2.amazonaws.com` elasticAWS EC2 Encryption Disabled elasticAWS EC2 Network Access Control List Creation elasticAWS EC2 Route Table Created elasticAWS EC2 Route Table Modified or Deleted elasticAWS EC2 Security Group Configuration Change elasticAWS EC2 Serial Console Access Enabled	6	20
`Provider_Name`	`eq`	`lambda.amazonaws.com` elasticAWS Lambda Event Source Mapping Creation elasticAWS Lambda Function Policy Updated to Allow Cross-Account Invocation elasticAWS Lambda Function Policy Updated to Allow Public Invocation elasticAWS Lambda Function URL Created with Public Access elasticAWS Lambda Layer Added to Existing Function elasticAWS Lambda Layer Shared Externally	6	12
`EventType`	`starts_with`	`AddPermission` elasticAWS Lambda Function Policy Updated to Allow Cross-Account Invocation elasticAWS Lambda Function Policy Updated to Allow Public Invocation	2	2
`aws::requestParameters`	`contains`	`lambda:invokefunction` elasticAWS Lambda Function Policy Updated to Allow Cross-Account Invocation elasticAWS Lambda Function Policy Updated to Allow Public Invocation	2	2
`All_Changes.action`	`eq`	`created` splunkCloud Security Groups Modifications by User	1	11
`All_Changes.action`	`eq`	`deleted` splunkCloud Security Groups Modifications by User	1
`All_Changes.action`	`eq`	`modified` splunkCloud Security Groups Modifications by User	1	3
`All_Changes.object_category`	`eq`	`security_group` splunkCloud Security Groups Modifications by User	1
`EventType`	`eq`	`ModifySnapshotAttribute` elasticAWS EC2 EBS Snapshot Access Removed	1	2
`EventType`	`eq`	`beta.compute.routes.insert` elasticGCP Virtual Private Cloud Route Creation	1
`EventType`	`eq`	`disableebsencryptionbydefault` elasticAWS EC2 Encryption Disabled	1
`EventType`	`eq`	`enableserialconsoleaccess` elasticAWS EC2 Serial Console Access Enabled	1
`EventType`	`eq`	`modifyinstanceattribute` elasticAWS EC2 Security Group Configuration Change	1	2
`EventType`	`eq`	`storage.buckets.update` elasticGCP Storage Bucket Configuration Modification	1
`EventType`	`in`	`ModifyDBCluster` elasticAWS RDS DB Instance or Cluster Deletion Protection Disabled	1	2
`EventType`	`in`	`ModifyDBInstance` elasticAWS RDS DB Instance or Cluster Deletion Protection Disabled	1	2
`EventType`	`in`	`authorizesecuritygroupegress` elasticAWS EC2 Security Group Configuration Change	1
`EventType`	`in`	`authorizesecuritygroupingress` elasticAWS EC2 Security Group Configuration Change	1
`EventType`	`in`	`createnetworkacl` elasticAWS EC2 Network Access Control List Creation	1
`EventType`	`in`	`createnetworkaclentry` elasticAWS EC2 Network Access Control List Creation	1	2
`EventType`	`in`	`createroute` elasticAWS EC2 Route Table Created	1
`EventType`	`in`	`createroutetable` elasticAWS EC2 Route Table Created	1
`EventType`	`in`	`createsecuritygroup` elasticAWS EC2 Security Group Configuration Change	1
`EventType`	`in`	`deleteroute` elasticAWS EC2 Route Table Modified or Deleted	1
`EventType`	`in`	`deleteroutetable` elasticAWS EC2 Route Table Modified or Deleted	1
`EventType`	`in`	`disassociateroutetable` elasticAWS EC2 Route Table Modified or Deleted	1
`EventType`	`in`	`modifysecuritygrouprules` elasticAWS EC2 Security Group Configuration Change	1

Exclusions (9 distinct)

These values appear most often in top-level exclusions.

Field	Kind	Value	Rules excluding
`aws::userAgent`	`contains`	`terraform` elasticAWS EC2 EBS Snapshot Access Removed elasticAWS EC2 Encryption Disabled elasticAWS EC2 Network Access Control List Creation elasticAWS EC2 Route Table Created elasticAWS EC2 Security Group Configuration Change elasticAWS Lambda Function Policy Updated to Allow Public Invocation elasticAWS Lambda Function URL Created with Public Access elasticAWS Lambda Layer Added to Existing Function elasticAWS RDS DB Instance or Cluster Deletion Protection Disabled	9
`aws::userAgent`	`contains`	`pulumi` elasticAWS EC2 EBS Snapshot Access Removed elasticAWS EC2 Network Access Control List Creation elasticAWS EC2 Route Table Created elasticAWS EC2 Security Group Configuration Change elasticAWS Lambda Function Policy Updated to Allow Public Invocation elasticAWS Lambda Function URL Created with Public Access elasticAWS Lambda Layer Added to Existing Function elasticAWS RDS DB Instance or Cluster Deletion Protection Disabled	8
`aws::userAgent`	`contains`	`ansible` elasticAWS EC2 Network Access Control List Creation elasticAWS EC2 Security Group Configuration Change elasticAWS Lambda Function URL Created with Public Access	3
`aws::requestParameters`	`contains`	`.amazonaws.com` elasticAWS Lambda Function Policy Updated to Allow Cross-Account Invocation	1
`aws::requestParameters`	`contains`	`principal=\*` elasticAWS Lambda Function Policy Updated to Allow Cross-Account Invocation	1
`aws::sourceIPAddress`	`eq`	`backup.amazonaws.com` elasticAWS EC2 EBS Snapshot Access Removed	1
`aws::userIdentity.arn`	`contains`	`ansible` elasticAWS Lambda Function URL Created with Public Access	1
`aws::userIdentity.arn`	`contains`	`pulumi` elasticAWS Lambda Function URL Created with Public Access	1
`aws::userIdentity.arn`	`contains`	`terraform` elasticAWS Lambda Function URL Created with Public Access	1

Rules under this technique

These vendors publish rules tagged with this technique.

Domain: Cloud

Elastic 18 rules

Splunk 1 rule

Cloud Security Groups Modifications by User

Modify Cloud Compute Infrastructure: Modify Cloud Compute Configurations T1578.005