Revert Cloud Instance

// Detect cloud instance snapshot revert operations (T1578.004)
// Covers Azure disk/VM restore operations and AWS snapshot-based recovery
let TimeWindow = 24h;
// Azure: Detect VM disk restore from snapshot, restore point operations, and VM recapture
let AzureRevertOps = AzureActivity
| where TimeGenerated > ago(TimeWindow)
| where OperationNameValue has_any (
    "Microsoft.Compute/disks/write",
    "Microsoft.Compute/restorePoints/write",
    "Microsoft.Compute/restorePointCollections/write",
    "Microsoft.Compute/virtualMachines/capture/action",
    "Microsoft.Compute/virtualMachines/write",
    "Microsoft.RecoveryServices/vaults/backupFabrics/protectionContainers/protectedItems/recovery/action"
  )
| where ActivityStatusValue =~ "Success"
| where Properties_d has_any ("snapshot", "restorePoint", "diskRestorePoint", "creationData", "Copy", "Restore")
| extend CloudProvider = "Azure"
| extend ActorIdentity = Caller
| extend SourceIP = CallerIpAddress
| extend Operation = OperationNameValue
| extend TargetResource = _ResourceId
| project TimeGenerated, CloudProvider, ActorIdentity, SourceIP, Operation, TargetResource, ResourceGroup, SubscriptionId;
// AWS: Detect EC2/EBS snapshot restore and instance revert operations via CloudTrail
let AWSRevertOps = AWSCloudTrail
| where TimeGenerated > ago(TimeWindow)
| where EventName in (
    "ImportSnapshot",
    "RestoreSnapshotTier",
    "CreateRestoreImageTask",
    "CopySnapshot",
    "RegisterImage",
    "RunInstances",
    "AttachVolume",
    "DetachVolume",
    "ModifyVolume",
    "StopInstances",
    "StartInstances"
  )
| where isempty(ErrorCode)
| extend CloudProvider = "AWS"
| extend ActorIdentity = UserIdentityArn
| extend SourceIP = SourceIpAddress
| extend Operation = EventName
| extend TargetResource = tostring(RequestParameters)
| project TimeGenerated, CloudProvider, ActorIdentity, SourceIP, Operation, TargetResource, AWSRegion, RecipientAccountId;
// Union results and annotate operation type
AzureRevertOps
| union AWSRevertOps
| extend IsEphemeralReset = (Operation in ("StopInstances", "StartInstances"))
| extend IsSnapshotRestore = (Operation has_any ("snapshot", "Snapshot", "restorePoint", "RestoreImage", "RegisterImage", "ImportSnapshot", "CopySnapshot", "RestoreSnapshotTier", "CreateRestoreImageTask", "recovery"))
| sort by TimeGenerated desc

(index=aws sourcetype="aws:cloudtrail"
  (eventName="ImportSnapshot" OR eventName="RestoreSnapshotTier" OR eventName="CreateRestoreImageTask"
   OR eventName="CopySnapshot" OR eventName="RegisterImage"
   OR eventName="AttachVolume" OR eventName="ModifyVolume"
   OR eventName="StopInstances" OR eventName="StartInstances"
   OR eventName="RunInstances")
  errorCode=""
| eval CloudProvider="AWS"
| eval ActorIdentity='userIdentity.arn'
| eval Operation=eventName
| eval TargetResource=coalesce('requestParameters.volumeId','requestParameters.instanceId','requestParameters.imageId',"unknown")
| eval SourceIP=sourceIPAddress
| eval IsSnapshotRestore=if(match(eventName,"(?i)(snapshot|RestoreImage|RegisterImage|ImportSnapshot|CopySnapshot|RestoreSnapshotTier|CreateRestoreImageTask)"),1,0)
| eval IsEphemeralReset=if(eventName="StopInstances" OR eventName="StartInstances",1,0)
| eval SuspicionScore=IsSnapshotRestore+IsEphemeralReset)
OR
(index=azure sourcetype="mscs:azure:eventhub"
  (operationName="MICROSOFT.COMPUTE/DISKS/WRITE"
   OR operationName="MICROSOFT.COMPUTE/RESTOREPOINTS/WRITE"
   OR operationName="MICROSOFT.COMPUTE/RESTOREPOINTCOLLECTIONS/WRITE"
   OR operationName="MICROSOFT.RECOVERYSERVICES/VAULTS/BACKUPFABRICS/PROTECTIONCONTAINERS/PROTECTEDITEMS/RECOVERY/ACTION"
   OR operationName="MICROSOFT.COMPUTE/VIRTUALMACHINES/CAPTURE/ACTION")
  status.value="Succeeded"
| eval CloudProvider="Azure"
| eval ActorIdentity=caller
| eval Operation=operationName
| eval TargetResource=resourceId
| eval SourceIP=callerIpAddress
| eval IsSnapshotRestore=if(match(_raw,"(?i)(snapshot|restorePoint|diskRestorePoint|creationData|\"Copy\")"),1,0)
| eval IsEphemeralReset=0
| eval SuspicionScore=IsSnapshotRestore)
| where SuspicionScore > 0
| table _time, CloudProvider, ActorIdentity, SourceIP, Operation, TargetResource, IsSnapshotRestore, IsEphemeralReset, SuspicionScore
| sort - _time

any where event.dataset == "azure.activitylogs"
  and event.action : ("Microsoft.Compute/snapshots/write", "Microsoft.Compute/virtualMachines/write",
                      "Microsoft.Compute/virtualMachines/delete", "Microsoft.Compute/disks/write")
  and not user.name : ("azure-backup-service", "azure-site-recovery")

SELECT
  DATEFORMAT(devicetime,'yyyy-MM-dd HH:mm:ss') AS EventTime,
  username, "Operation" AS CloudOperation,
  "ResourceType" AS CloudResource,
  "ResourceGroup", "SubscriptionId",
  CASE
    WHEN "Operation" ILIKE '%delete%' OR "Operation" ILIKE '%destroy%' THEN 90
    WHEN "Operation" ILIKE '%snapshot%' AND "ResultType" = 'Success' THEN 70
    WHEN "Operation" ILIKE '%create%instance%' THEN 60
    ELSE 40
  END AS RiskScore,
  CASE
    WHEN "Operation" ILIKE '%delete%' THEN 'Cloud Resource Deletion'
    WHEN "Operation" ILIKE '%snapshot%' THEN 'Snapshot Operation'
    WHEN "Operation" ILIKE '%create%' THEN 'Cloud Resource Creation'
    ELSE 'Cloud Modification'
  END AS AlertType
FROM events
WHERE LOGSOURCETYPENAME(devicetype) ILIKE '%azure%' OR LOGSOURCETYPENAME(devicetype) ILIKE '%cloudtrail%'
  AND ("Operation" ILIKE '%compute%' OR "Operation" ILIKE '%instance%' OR "Operation" ILIKE '%snapshot%' OR "Operation" ILIKE '%virtualMachine%')
  AND username NOT ILIKE '%azure%automation%'
  AND username NOT ILIKE '%backup%service%'
ORDER BY RiskScore DESC
LAST 1 HOURS

_sourceCategory=*azure*activitylog* OR _sourceCategory=*aws*cloudtrail*
| json auto
| where matches(operationName, "(?i)(snapshot|virtualMachine|instance|compute|create|delete|modify)")
| eval RiskLevel = if(matches(operationName, "(?i)(delete|destroy|terminate)"), "High",
    if(matches(operationName, "(?i)(snapshot|create)"), "Medium", "Low"))
| where RiskLevel in ("High","Medium")
| eval AlertType = if(matches(operationName, "(?i)delete"), "Cloud Resource Deletion",
    if(matches(operationName, "(?i)snapshot"), "Snapshot Operation",
    if(matches(operationName, "(?i)create"), "Resource Creation", "Cloud Modification")))
| where caller != "azure-backup" and !matches(caller, "(?i)automation")
| stats count AS OpCount, values(operationName) AS Operations, values(RiskLevel) AS RiskLevels by _sourceHost, caller, resourceGroup
| sort by OpCount desc

rule T1578_004_cloud_infra_modification {
  meta:
    author = "Detection Engineering"
    description = "Detects suspicious cloud infrastructure modifications"
    severity = "high"
    confidence = "medium"
    mitre_attack = "T1578.004"
    reference = "https://attack.mitre.org/techniques/T1578/004/"

  events:
    $e.metadata.event_type = "USER_RESOURCE_ACCESS"
    re.regex($e.metadata.product_event_type, `(?i)(snapshot|virtualMachine|instance|compute|create|delete|modify)`)
    not re.regex($e.principal.user.email_addresses, `(?i)(backup|automation|serviceaccount)`)

  condition:
    $e
}

#event_simpleName = "CloudResourceModification"
| OperationName = /(?i)(snapshot|virtualMachine|instance|compute|create|delete|modify|revert)/
| ActorUserName != /(?i)(backup|automation|serviceaccount|scheduler)/
| groupBy([aid, ActorUserName, OperationName, ResourceType, ResourceName], function=[count(as=OpCount), min(timestamp, as=FirstSeen)])
| case {
    OperationName = /(?i)(delete|destroy|terminate)/ => RiskScore := "High";
    OperationName = /(?i)(snapshot|create)/ => RiskScore := "Medium";
    * => RiskScore := "Low";
  }
| where RiskScore in ("High", "Medium")
| table([ActorUserName, OperationName, ResourceType, ResourceName, OpCount, RiskScore, FirstSeen])
| sort(RiskScore)