T1578.005 Modify Cloud Compute Configurations Detection — KQL & SPL Queries for Sentinel and Splunk

Microsoft Sentinel / Defender

kusto

let SuspiciousComputeOps = dynamic([
  "MICROSOFT.QUOTA/QUOTAS/WRITE",
  "MICROSOFT.QUOTA/QUOTAREQUESTS/WRITE",
  "MICROSOFT.CAPACITY/CATALOGS/OFFERS/WRITE",
  "MICROSOFT.COMPUTE/LOCATIONS/USAGES/WRITE",
  "MICROSOFT.AUTHORIZATION/POLICYASSIGNMENTS/WRITE",
  "MICROSOFT.AUTHORIZATION/POLICYASSIGNMENTS/DELETE",
  "MICROSOFT.AUTHORIZATION/POLICYEXEMPTIONS/WRITE",
  "MICROSOFT.AUTHORIZATION/POLICYEXEMPTIONS/WRITE",
  "MICROSOFT.AUTHORIZATION/POLICYSETDEFINITIONS/WRITE",
  "MICROSOFT.AUTHORIZATION/POLICYSETDEFINITIONS/DELETE",
  "MICROSOFT.SUBSCRIPTION/SUBSCRIPTIONS/LOCATIONS/WRITE",
  "MICROSOFT.FEATURES/FEATURES/REGISTER",
  "MICROSOFT.FEATURES/PROVIDERS/FEATURES/REGISTER"
]);
AzureActivity
| where TimeGenerated > ago(24h)
| where tostring(OperationNameValue) has_any (SuspiciousComputeOps)
| where ActivityStatusValue =~ "Success" or ActivityStatusValue =~ "Succeeded"
| extend CallerUPN = tostring(Claims.upn)
| extend CallerAppId = tostring(Claims.appid)
| extend CallerObjectId = tostring(Claims.oid)
| extend IsServicePrincipal = isempty(CallerUPN)
| extend EffectiveCaller = iif(IsServicePrincipal, strcat("SP:", CallerAppId), CallerUPN)
| extend PolicyOperation = OperationNameValue has "POLICYASSIGNMENT" or OperationNameValue has "POLICYEXEMPTION" or OperationNameValue has "POLICYSETDEFINITION"
| extend QuotaOperation = OperationNameValue has "QUOTA" or OperationNameValue has "CAPACITY"
| extend RegionOperation = OperationNameValue has "LOCATIONS" or OperationNameValue has "FEATURES"
| project TimeGenerated, CallerIpAddress, EffectiveCaller, CallerUPN, CallerAppId, IsServicePrincipal,
         OperationNameValue, ResourceGroup, _ResourceId, SubscriptionId,
         PolicyOperation, QuotaOperation, RegionOperation,
         Properties, HTTPRequest
| sort by TimeGenerated desc

high severity medium confidence

Data Sources

Cloud Service: Cloud Service Modification Azure Activity Log Azure Resource Manager Azure Policy

Required Tables

AzureActivity

False Positives

Cloud infrastructure teams legitimately requesting quota increases for planned expansion or new workloads
Azure Policy assignments being modified during sanctioned governance reviews or policy updates by the security team
DevOps automation pipelines (Terraform, Bicep, Azure DevOps) that manage infrastructure-as-code including policy and quota configurations
Cloud governance tooling (Azure Blueprints, Defender for Cloud regulatory compliance) that modifies policy assignments as part of compliance remediation
Service principals used by approved CSPM or cloud management platforms that regularly enumerate or adjust resource configurations

Splunk

spl

index=azure sourcetype="azure:activity"
  (operationName="Microsoft.Quota/quotas/write"
   OR operationName="Microsoft.Quota/quotaRequests/write"
   OR operationName="Microsoft.Authorization/policyAssignments/write"
   OR operationName="Microsoft.Authorization/policyAssignments/delete"
   OR operationName="Microsoft.Authorization/policyExemptions/write"
   OR operationName="Microsoft.Authorization/policySetDefinitions/write"
   OR operationName="Microsoft.Authorization/policySetDefinitions/delete"
   OR operationName="Microsoft.Compute/locations/usages/write"
   OR operationName="Microsoft.Features/features/register"
   OR operationName="Microsoft.Features/providers/features/register"
   OR operationName="Microsoft.Subscription/subscriptions/locations/write")
  status="Succeeded"
| eval CallerUPN=coalesce('claims.upn', "")
| eval CallerAppId=coalesce('claims.appid', "")
| eval IsServicePrincipal=if(len(CallerUPN)==0, 1, 0)
| eval EffectiveCaller=if(IsServicePrincipal==1, "SP:".CallerAppId, CallerUPN)
| eval PolicyOperation=if(match(operationName, "(?i)policyAssignment|policyExemption|policySetDefinition"), 1, 0)
| eval QuotaOperation=if(match(operationName, "(?i)quota|capacity"), 1, 0)
| eval RegionOperation=if(match(operationName, "(?i)locations/write|features/register"), 1, 0)
| eval RiskScore=PolicyOperation + QuotaOperation + RegionOperation
| table _time, EffectiveCaller, CallerUPN, CallerAppId, IsServicePrincipal, callerIpAddress,
        operationName, resourceGroup, subscriptionId,
        PolicyOperation, QuotaOperation, RegionOperation, RiskScore
| sort - _time

high severity medium confidence

Data Sources

Cloud Service: Cloud Service Modification Azure Activity Log Azure Resource Manager

Required Sourcetypes

azure:activity

False Positives

Cloud infrastructure teams legitimately requesting quota increases for planned expansion or new workloads
Azure Policy assignments being modified during sanctioned governance reviews or policy updates by the security team
DevOps automation pipelines (Terraform, Bicep, Azure DevOps) that manage infrastructure-as-code including policy and quota configurations
Cloud governance tooling (Azure Blueprints, Defender for Cloud regulatory compliance) that modifies policy assignments as part of compliance remediation
Service principals used by approved CSPM or cloud management platforms that regularly enumerate or adjust resource configurations

Elastic Security (EQL)

eql

any where event.dataset == "azure.activitylogs"
  and event.action : ("Microsoft.Compute/snapshots/write", "Microsoft.Compute/virtualMachines/write",
                      "Microsoft.Compute/virtualMachines/delete", "Microsoft.Compute/disks/write")
  and not user.name : ("azure-backup-service", "azure-site-recovery")

high severity medium confidence

Data Sources

Azure Activity Logs AWS CloudTrail

Required Tables

logs-azure.activitylogs.* logs-aws.cloudtrail.*

False Positives

Authorized cloud administrators performing routine snapshot operations
Automated backup solutions creating scheduled snapshots via service accounts
Disaster recovery testing that involves creating and sharing snapshots across accounts
DevOps pipelines that create instance images as part of CI/CD workflows

IBM QRadar (AQL)

sql

SELECT
  DATEFORMAT(devicetime,'yyyy-MM-dd HH:mm:ss') AS EventTime,
  username, "Operation" AS CloudOperation,
  "ResourceType" AS CloudResource,
  "ResourceGroup", "SubscriptionId",
  CASE
    WHEN "Operation" ILIKE '%delete%' OR "Operation" ILIKE '%destroy%' THEN 90
    WHEN "Operation" ILIKE '%snapshot%' AND "ResultType" = 'Success' THEN 70
    WHEN "Operation" ILIKE '%create%instance%' THEN 60
    ELSE 40
  END AS RiskScore,
  CASE
    WHEN "Operation" ILIKE '%delete%' THEN 'Cloud Resource Deletion'
    WHEN "Operation" ILIKE '%snapshot%' THEN 'Snapshot Operation'
    WHEN "Operation" ILIKE '%create%' THEN 'Cloud Resource Creation'
    ELSE 'Cloud Modification'
  END AS AlertType
FROM events
WHERE LOGSOURCETYPENAME(devicetype) ILIKE '%azure%' OR LOGSOURCETYPENAME(devicetype) ILIKE '%cloudtrail%'
  AND ("Operation" ILIKE '%compute%' OR "Operation" ILIKE '%instance%' OR "Operation" ILIKE '%snapshot%' OR "Operation" ILIKE '%virtualMachine%')
  AND username NOT ILIKE '%azure%automation%'
  AND username NOT ILIKE '%backup%service%'
ORDER BY RiskScore DESC
LAST 1 HOURS

high severity medium confidence

Data Sources

Azure Activity Logs AWS CloudTrail

Required Tables

events

False Positives

Authorized cloud administrators performing snapshot and backup operations
Automated DR solutions creating scheduled cloud instance snapshots
DevOps pipelines creating and deleting instances as part of CI/CD
Authorized infrastructure scaling or migration events

Sumo Logic CSE

sql

_sourceCategory=*azure*activitylog* OR _sourceCategory=*aws*cloudtrail*
| json auto
| where matches(operationName, "(?i)(snapshot|virtualMachine|instance|compute|create|delete|modify)")
| eval RiskLevel = if(matches(operationName, "(?i)(delete|destroy|terminate)"), "High",
    if(matches(operationName, "(?i)(snapshot|create)"), "Medium", "Low"))
| where RiskLevel in ("High","Medium")
| eval AlertType = if(matches(operationName, "(?i)delete"), "Cloud Resource Deletion",
    if(matches(operationName, "(?i)snapshot"), "Snapshot Operation",
    if(matches(operationName, "(?i)create"), "Resource Creation", "Cloud Modification")))
| where caller != "azure-backup" and !matches(caller, "(?i)automation")
| stats count AS OpCount, values(operationName) AS Operations, values(RiskLevel) AS RiskLevels by _sourceHost, caller, resourceGroup
| sort by OpCount desc

high severity medium confidence

Data Sources

Azure Activity Logs AWS CloudTrail

Required Tables

_sourceCategory=*azure* _sourceCategory=*aws*cloudtrail*

False Positives

Cloud administrators creating authorized snapshots for backup or migration
Automated disaster recovery systems creating scheduled cloud snapshots
DevOps pipelines creating and deleting compute instances as part of CI/CD
Authorized cloud infrastructure migrations between regions or accounts

Google Chronicle / SecOps

yaral

rule T1578_005_cloud_infra_modification {
  meta:
    author = "Detection Engineering"
    description = "Detects suspicious cloud infrastructure modifications"
    severity = "high"
    confidence = "medium"
    mitre_attack = "T1578.005"
    reference = "https://attack.mitre.org/techniques/T1578/005/"

  events:
    $e.metadata.event_type = "USER_RESOURCE_ACCESS"
    re.regex($e.metadata.product_event_type, `(?i)(snapshot|virtualMachine|instance|compute|create|delete|modify)`)
    not re.regex($e.principal.user.email_addresses, `(?i)(backup|automation|serviceaccount)`)

  condition:
    $e
}

high severity medium confidence

Data Sources

Google Chronicle SIEM Cloud audit logs (Azure/AWS)

Required Tables

USER_RESOURCE_ACCESS

False Positives

Authorized cloud administrators performing scheduled backup snapshot creation
Automated disaster recovery solutions creating routine cloud instance snapshots
DevOps CI/CD pipelines creating and deleting compute instances during deployments
Authorized cloud migration projects moving instances between regions

CrowdStrike LogScale (CQL)

cql

#event_simpleName = "CloudResourceModification"
| OperationName = /(?i)(snapshot|virtualMachine|instance|compute|create|delete|modify|revert)/
| ActorUserName != /(?i)(backup|automation|serviceaccount|scheduler)/
| groupBy([aid, ActorUserName, OperationName, ResourceType, ResourceName], function=[count(as=OpCount), min(timestamp, as=FirstSeen)])
| case {
    OperationName = /(?i)(delete|destroy|terminate)/ => RiskScore := "High";
    OperationName = /(?i)(snapshot|create)/ => RiskScore := "Medium";
    * => RiskScore := "Low";
  }
| where RiskScore in ("High", "Medium")
| table([ActorUserName, OperationName, ResourceType, ResourceName, OpCount, RiskScore, FirstSeen])
| sort(RiskScore)

high severity medium confidence

Data Sources

CrowdStrike Falcon Horizon (Cloud Security) Cloud audit logs

Required Tables

CloudResourceModification

False Positives

Authorized cloud administrators performing routine snapshot and backup operations
Automated DR and backup solutions creating scheduled cloud instance snapshots
DevOps CI/CD pipelines that create and destroy cloud instances during deployments
Authorized cloud migration projects moving or replicating compute instances

Modify Cloud Compute Configurations

Data Sources

Required Tables

False Positives

Data Sources

Required Sourcetypes

False Positives

Data Sources

Required Tables

False Positives

Data Sources

Required Tables

False Positives

Data Sources

Required Tables

False Positives

Data Sources

Required Tables

False Positives

Data Sources

Required Tables

False Positives

Response Playbook

Investigation Guide

Atomic Red Team Tests

Unlock Pro Content

Related Detections

Parent Technique

Related Sub-techniques

Same Tactic: Defense Evasion

Popular Detections