T1578 Modify Cloud Compute Infrastructure
EnterpriseAn adversary may attempt to modify a cloud account's compute service infrastructure to evade defenses. A modification to the compute service infrastructure can include the creation, deletion, or modification of one or more components such as compute instances, virtual machines, and snapshots. Permissions gained from the modification of infrastructure components may bypass restrictions that prevent access to existing infrastructure. Modifying infrastructure components may also allow an adversary to evade detection and remove evidence of their presence.
platforms
Platforms this applies to.
tactics
ATT&CK tactics this technique serves.
sub-techniques (5)
More specific entries beneath this one.
mitigations
ATT&CK mitigations that reduce this.
detected by (9)
Data components that detect this.
NIST CSF 2.0 — areas of relevance (Protect / Detect)
NIST CSF 2.0 areas this most relates to (evidence-ranked).
- PR.AAIdentity Management, Authentication, and Access Controlstrong · backed by 7 of 11 mapped controls
- PR.DSData Securitymoderate · backed by 3 of 11 mapped controls
- DE.CMContinuous Monitoringweak · backed by 2 of 11 mapped controls
Derived from MITRE CTID (Apache-2.0) and the NIST 800-53 ↔ CSF crosswalk (public domain). Indicative relevance along the Protect/Detect axis — not a compliance assessment or coverage claim.
mitigating controls (11)
Security controls that mitigate this.
Detected by (Sigma) (1)
Sigma detection rules related to this.
source
Where this definition is published.