Detect Delete Cloud Instance in Microsoft Sentinel
An adversary may delete a cloud instance after performing malicious activities in an attempt to evade detection and remove evidence of their presence. Deleting an instance or virtual machine can eliminate forensic artifacts including memory contents, running processes, local logs, and volatile state that would otherwise be available for incident response. Adversaries such as LAPSUS$ have deleted target cloud resources to trigger incident response processes and maximize disruption, while ransomware operators like Storm-0501 conduct mass deletion of Azure resources across subscriptions. The technique may be combined with T1578.002 (Create Cloud Instance) where adversaries spin up ephemeral instances for malicious work, then delete them upon completion.
MITRE ATT&CK
- Tactic
- Defense Evasion
- Sub-technique
- T1578.003 Delete Cloud Instance
- Canonical reference
- https://attack.mitre.org/techniques/T1578/003/
KQL Detection Query
// T1578.003 — Delete Cloud Instance
// Detects VM/instance deletion events across Azure and AWS in Microsoft Sentinel
let AzureDeleteOps = dynamic([
"Microsoft.Compute/virtualMachines/delete",
"Microsoft.Compute/virtualMachineScaleSets/delete",
"Microsoft.Compute/virtualMachineScaleSets/virtualMachines/delete",
"Microsoft.ClassicCompute/virtualMachines/delete",
"Microsoft.ContainerService/managedClusters/delete"
]);
// Azure Activity Log — VM deletions
let AzureVMDeletes = AzureActivity
| where TimeGenerated > ago(24h)
| where OperationNameValue in~ (AzureDeleteOps)
| where ActivityStatusValue in~ ("Success", "Accepted", "Succeeded", "Started")
| extend CloudProvider = "Azure"
| extend CallerIdentity = Caller
| extend OperationType = OperationNameValue
| extend ResourceName = Resource
| extend AccountType = iif(CallerIdentity has "@", "UserAccount", "ServicePrincipal")
| project TimeGenerated, CloudProvider, CallerIdentity, AccountType, OperationType,
ResourceName, ResourceGroup, SubscriptionId, ResourceId,
ActivityStatusValue, Properties, HTTPRequest;
// AWS CloudTrail — Instance terminations
let AWSInstanceTerminations = AWSCloudTrail
| where TimeGenerated > ago(24h)
| where EventName in ("TerminateInstances", "DeleteInstance", "DeregisterInstance")
| where isempty(ErrorCode)
| extend CloudProvider = "AWS"
| extend CallerIdentity = UserIdentityArn
| extend AccountType = UserIdentityType
| extend OperationType = EventName
| extend ResourceName = tostring(RequestParameters)
| project TimeGenerated, CloudProvider, CallerIdentity, AccountType, OperationType,
ResourceName, SourceIpAddress, AWSRegion, UserIdentityAccountId,
UserIdentityType, SessionCreationDate, AdditionalEventData;
// Union both cloud providers
AzureVMDeletes
| union AWSInstanceTerminations
| sort by TimeGenerated descDetects cloud instance deletion events across Azure (via AzureActivity) and AWS (via AWSCloudTrail) in Microsoft Sentinel. Covers Azure VM, VMSS, and AKS cluster deletions alongside AWS EC2 TerminateInstances and DeregisterInstance API calls. Enriches results with caller identity type to distinguish user-initiated vs service-principal-initiated deletions. Successful deletions (not errors/access-denied) are prioritized to reduce noise from failed unauthorized attempts.
Data Sources
Required Tables
False Positives & Tuning
- Auto-scaling scale-in events where the cloud platform terminates instances to reduce capacity based on policy
- Infrastructure as Code (Terraform, Pulumi, CloudFormation) teardown operations during legitimate environment decommissioning
- DevOps CI/CD pipeline cleanup jobs that destroy ephemeral test or staging environments after pipeline completion
- Cloud cost optimization scripts (AWS Instance Scheduler, Azure DevTest Labs auto-shutdown) deleting idle instances on schedule
- Spot instance / preemptible VM reclamation by the cloud provider (appears as TerminateInstances from platform service roles)
Other platforms for T1578.003
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1AWS EC2 Instance Termination via CLI
Expected signal: AWS CloudTrail: EventName=TerminateInstances with RequestParameters containing instancesSet.items[].instanceId. UserIdentity will contain the caller's ARN, userAgent will show 'aws-cli', and sourceIPAddress will show the test machine's IP. ResponseElements will confirm state transition from 'running' to 'shutting-down'. Event appears in CloudTrail within 5-15 minutes.
- Test 2AWS Bulk EC2 Termination — Mass Deletion Pattern
Expected signal: AWS CloudTrail: Single TerminateInstances event with RequestParameters.instancesSet.items containing 5 instance IDs. The bulk nature triggers the high-count hunting query. UserIdentity, sourceIPAddress, and awsRegion fields present. The SPL query InstanceCount field will show 5, triggering BulkDelete classification and elevated SuspicionScore.
- Test 3Azure VM Deletion via Azure CLI
Expected signal: Azure Activity Log: OperationNameValue=Microsoft.Compute/virtualMachines/delete, ActivityStatusValue=Accepted then Succeeded (two events). Caller field contains the authenticated user's UPN or service principal ID. ResourceId contains the full VM resource path. Events appear in Azure Monitor Activity Log within 1-5 minutes and flow to Log Analytics/Sentinel within 5-15 minutes.
- Test 4AWS Bypass Termination Protection Then Terminate
Expected signal: AWS CloudTrail Event 1: EventName=ModifyInstanceAttribute with RequestParameters.attribute=disableApiTermination and RequestParameters.value=false. AWS CloudTrail Event 2: EventName=TerminateInstances with the same instance ID and caller identity. Both events share the same UserIdentityArn and sourceIPAddress. The sequence within minutes is the high-fidelity indicator. A correlation rule matching ModifyInstanceAttribute(disableApiTermination=false) followed by TerminateInstances from the same ARN within 10 minutes should fire at Critical severity.
References (10)
- https://attack.mitre.org/techniques/T1578/003/
- https://aws.amazon.com/premiumsupport/knowledge-center/cloudtrail-search-api-calls/
- https://cloud.google.com/logging/docs/audit#admin-activity
- https://docs.microsoft.com/en-us/azure/azure-resource-manager/management/view-activity-logs
- https://www.mandiant.com/sites/default/files/2021-09/mtrends-2020.pdf
- https://www.microsoft.com/en-us/security/blog/2022/03/22/dev-0537-criminal-actor-targeting-organizations-for-data-exfiltration-and-destruction/
- https://www.microsoft.com/en-us/security/blog/2025/08/01/storm-0501-ransomware-attacks-expanding-to-cloud-environments/
- https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/terminating-instances.html#Using_ChangingDisableAPITermination
- https://docs.microsoft.com/en-us/azure/azure-resource-manager/management/lock-resources
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1578.003/T1578.003.md
Unlock Pro Content
Get the full detection package for T1578.003 including response playbook, investigation guide, and atomic red team tests.