Which SIEM platforms have a T1578.002 detection rule?

df00tech provides T1578.002 (Create Cloud Instance) detection queries for 7 SIEM platforms: Microsoft Sentinel / Defender, Splunk, Elastic Security (EQL), IBM QRadar (AQL), Sumo Logic CSE, Google Chronicle / SecOps, CrowdStrike LogScale (CQL).

What data sources are required to detect Create Cloud Instance (T1578.002)?

Detecting Create Cloud Instance requires the following data sources: Cloud Service: Cloud Service Modification, Azure Activity Logs, AWS CloudTrail, Microsoft Sentinel AzureActivity table, Microsoft Sentinel AWSCloudTrail table.

What severity and confidence is the T1578.002 detection?

The T1578.002 detection is rated high severity with medium confidence.

What are common false positives for T1578.002?

Common false positives for T1578.002 include: Authorized DevOps pipelines and CI/CD systems (GitHub Actions, Azure DevOps, Jenkins) that create ephemeral compute instances for build and test workloads — typically identifiable by service principal caller identity; Auto-scaling group events triggered by legitimate load spikes — cloud-native scaling policies routinely invoke RunInstances without human intervention; Infrastructure-as-Code deployments (Terraform, Pulumi, Bicep, CloudFormation) run by authorized engineers during planned change windows.

T1578.002 IBM QRadar · QRadar

Detect Create Cloud Instance in IBM QRadar

An adversary may create a new instance or virtual machine (VM) within the compute service of a cloud account to evade defenses. Creating a new instance may allow an adversary to bypass firewall rules and permissions that exist on instances currently residing within an account. An adversary may create a snapshot of one or more volumes in an account, create a new instance, mount the snapshots, and then apply a less restrictive security policy to collect data from local system or for remote data staging. LAPSUS$ has been observed creating new virtual machines within target cloud environments after leveraging credential access to cloud assets. Scattered Spider has created Amazon EC2 instances within victim environments to establish persistence and stage exfiltrated data. This technique enables adversaries to operate in an isolated compute environment without affecting existing running instances, evading endpoint-based detection tools that only monitor known workloads.

MITRE ATT&CK

Tactic: Defense Evasion
Technique: T1578 Modify Cloud Compute Infrastructure
Sub-technique: T1578.002 Create Cloud Instance
Canonical reference: https://attack.mitre.org/techniques/T1578/002/

QRadar Detection Query

IBM QRadar (QRadar)

sql

SELECT
  DATEFORMAT(devicetime,'yyyy-MM-dd HH:mm:ss') AS EventTime,
  username, "Operation" AS CloudOperation,
  "ResourceType" AS CloudResource,
  "ResourceGroup", "SubscriptionId",
  CASE
    WHEN "Operation" ILIKE '%delete%' OR "Operation" ILIKE '%destroy%' THEN 90
    WHEN "Operation" ILIKE '%snapshot%' AND "ResultType" = 'Success' THEN 70
    WHEN "Operation" ILIKE '%create%instance%' THEN 60
    ELSE 40
  END AS RiskScore,
  CASE
    WHEN "Operation" ILIKE '%delete%' THEN 'Cloud Resource Deletion'
    WHEN "Operation" ILIKE '%snapshot%' THEN 'Snapshot Operation'
    WHEN "Operation" ILIKE '%create%' THEN 'Cloud Resource Creation'
    ELSE 'Cloud Modification'
  END AS AlertType
FROM events
WHERE LOGSOURCETYPENAME(devicetype) ILIKE '%azure%' OR LOGSOURCETYPENAME(devicetype) ILIKE '%cloudtrail%'
  AND ("Operation" ILIKE '%compute%' OR "Operation" ILIKE '%instance%' OR "Operation" ILIKE '%snapshot%' OR "Operation" ILIKE '%virtualMachine%')
  AND username NOT ILIKE '%azure%automation%'
  AND username NOT ILIKE '%backup%service%'
ORDER BY RiskScore DESC
LAST 1 HOURS

high severity medium confidence

QRadar AQL detection for Create Cloud Instance. Detects cloud instance creation events across Azure (AzureActivity) and AWS (AWSCloudTrail) in Microsoft Sentinel. Targets successful VM/instance creation operations that could indicate adversary infr

Data Sources

Azure Activity LogsAWS CloudTrail

Required Tables

events

False Positives & Tuning

Authorized cloud administrators performing snapshot and backup operations
Automated DR solutions creating scheduled cloud instance snapshots
DevOps pipelines creating and deleting instances as part of CI/CD
Authorized infrastructure scaling or migration events

Download portable Sigma rule (.yml)

Other platforms for T1578.002

Microsoft Sentinel (KQL) Splunk (SPL) Elastic Security (Elastic) Sumo Logic CSE (Sumo) Google Chronicle (YARA-L) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

Test 1Create AWS EC2 Instance via CLI
Expected signal: AWS CloudTrail: RunInstances event with eventSource=ec2.amazonaws.com, eventName=RunInstances, userIdentity block showing caller ARN and accountId, requestParameters.instancesSet containing imageId and instanceType t2.micro, responseElements.instancesSet.items[0].instanceId with the assigned instance ID. Event appears in CloudTrail within 5-15 minutes and in Microsoft Sentinel AWSCloudTrail table within 15-30 minutes depending on connector polling interval.
Test 2Create Azure Virtual Machine via CLI
Expected signal: Azure Activity Log: Microsoft.Compute/virtualMachines/write operation with ActivityStatus=Succeeded, Caller showing the authenticated UPN or service principal object ID, CallerIpAddress of the machine running the Azure CLI, ResourceGroup=df00tech-atomic-test-rg. Also generates Microsoft.Resources/resourceGroups/write event for the preceding resource group creation. Events appear in Azure Activity Log within 5 minutes and in Microsoft Sentinel AzureActivity table within 10-15 minutes.
Test 3Create GCP Compute Engine Instance via gcloud CLI
Expected signal: GCP Cloud Audit Log: compute.instances.insert activity log entry with principalEmail showing the authenticated caller, requestMetadata.callerIp, resource.labels.instance_id and resource.labels.zone populated. Visible in GCP Cloud Logging under GCE Audit Logs (Admin Activity). If exported to Microsoft Sentinel via GCP Pub/Sub connector: GCPAuditLogs table with MethodName=v1.compute.instances.insert and Severity=NOTICE (success).
Test 4Snapshot-then-Create-Instance Data Staging Pattern (Mandiant M-Trends)
Expected signal: AWS CloudTrail sequence: (1) CreateVolume event with responseElements.volumeId, (2) CreateSnapshot event with requestParameters.volumeId and responseElements.snapshotId from the same userIdentity.arn, (3) RunInstances event with requestParameters.blockDeviceMapping containing the snapshotId in the Ebs block. All three events share the same userIdentity.arn and sessionContext. Entire sequence visible in CloudTrail within 15 minutes.

Last updated: 2026-03-13 Research depth: deep

References (10)

Response Playbook

1. Examine the full command line and decode any Base64 content...
2. Identify the parent process chain and user context...
3. Check for concurrent network connections from the process...

Investigation Guide

Related techniques: T1027, T1105, T1562.001...
Forensic artifacts: PSReadLine history, Prefetch, ScriptBlock logs...

Atomic Red Team Tests

Test 1: Encoded command execution...
Test 2: Download cradle via Net.WebClient...

Unlock Pro Content

Get the full detection package for T1578.002 including response playbook, investigation guide, and atomic red team tests.

Response PlaybookInvestigation GuideHunting QueriesAtomic Red Team TestsTuning Guidance

Detect Create Cloud Instance in IBM QRadar

MITRE ATT&CK

QRadar Detection Query

Data Sources

Required Tables

False Positives & Tuning

Other platforms for T1578.002

Testing Methodology

Response Playbook

Investigation Guide

Atomic Red Team Tests

Unlock Pro Content

Related Detections

Parent Technique

Related Sub-techniques

Related Techniques

Same Tactic: Defense Evasion

Popular Detections

MITRE ATT&CK

QRadar Detection Query

Data Sources

Required Tables

False Positives & Tuning

Other platforms for T1578.002

Testing Methodology

Unlock Pro Content

Related Detections

Parent Technique

Related Sub-techniques

Related Techniques

Same Tactic: Defense Evasion

Popular Detections

Get new detections in your inbox