Detect Modify Cloud Compute Configurations in Splunk
Adversaries may modify settings that directly affect the size, locations, and resources available to cloud compute infrastructure in order to evade defenses or abuse victim resources. Targeted configurations include service quotas, subscription-level policies that restrict VM sizes or regions, tenant-wide Azure Policy assignments, and cloud provider quota request workflows. By increasing allowed compute quotas or removing policy guardrails, adversaries can launch large GPU/CPU instances for cryptomining or deploy resources in unsupported regions that lack monitoring coverage — all without triggering standard resource-creation alerts that assume baseline quota limits. Real-world incidents include compromised Azure tenants where attackers submitted quota increase requests for high-core-count VM SKUs (Standard_NC series for GPU mining) and removed Azure Policy assignments that enforced allowed VM sizes, enabling deployment of previously blocked instance types.
MITRE ATT&CK
- Tactic
- Defense Evasion
- Sub-technique
- T1578.005 Modify Cloud Compute Configurations
- Canonical reference
- https://attack.mitre.org/techniques/T1578/005/
SPL Detection Query
index=azure sourcetype="azure:activity"
(operationName="Microsoft.Quota/quotas/write"
OR operationName="Microsoft.Quota/quotaRequests/write"
OR operationName="Microsoft.Authorization/policyAssignments/write"
OR operationName="Microsoft.Authorization/policyAssignments/delete"
OR operationName="Microsoft.Authorization/policyExemptions/write"
OR operationName="Microsoft.Authorization/policySetDefinitions/write"
OR operationName="Microsoft.Authorization/policySetDefinitions/delete"
OR operationName="Microsoft.Compute/locations/usages/write"
OR operationName="Microsoft.Features/features/register"
OR operationName="Microsoft.Features/providers/features/register"
OR operationName="Microsoft.Subscription/subscriptions/locations/write")
status="Succeeded"
| eval CallerUPN=coalesce('claims.upn', "")
| eval CallerAppId=coalesce('claims.appid', "")
| eval IsServicePrincipal=if(len(CallerUPN)==0, 1, 0)
| eval EffectiveCaller=if(IsServicePrincipal==1, "SP:".CallerAppId, CallerUPN)
| eval PolicyOperation=if(match(operationName, "(?i)policyAssignment|policyExemption|policySetDefinition"), 1, 0)
| eval QuotaOperation=if(match(operationName, "(?i)quota|capacity"), 1, 0)
| eval RegionOperation=if(match(operationName, "(?i)locations/write|features/register"), 1, 0)
| eval RiskScore=PolicyOperation + QuotaOperation + RegionOperation
| table _time, EffectiveCaller, CallerUPN, CallerAppId, IsServicePrincipal, callerIpAddress,
operationName, resourceGroup, subscriptionId,
PolicyOperation, QuotaOperation, RegionOperation, RiskScore
| sort - _timeDetects Azure cloud compute configuration modifications using the Azure Activity log sourcetype from the Splunk Add-on for Microsoft Cloud Services. Covers quota increase requests, policy assignment and exemption changes, policy set definition modifications, region/feature registrations, and VM usage limit writes. Evaluates each event against three risk categories (policy, quota, region) and assigns a cumulative risk score. Service principal callers are flagged explicitly as they represent automation that may indicate a compromised application identity.
Data Sources
Required Sourcetypes
False Positives & Tuning
- Cloud infrastructure teams legitimately requesting quota increases for planned expansion or new workloads
- Azure Policy assignments being modified during sanctioned governance reviews or policy updates by the security team
- DevOps automation pipelines (Terraform, Bicep, Azure DevOps) that manage infrastructure-as-code including policy and quota configurations
- Cloud governance tooling (Azure Blueprints, Defender for Cloud regulatory compliance) that modifies policy assignments as part of compliance remediation
- Service principals used by approved CSPM or cloud management platforms that regularly enumerate or adjust resource configurations
Other platforms for T1578.005
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Azure Quota Increase Request via Azure CLI
Expected signal: AzureActivity log entry with OperationNameValue='MICROSOFT.QUOTA/QUOTAREQUESTS/WRITE', ActivityStatusValue='Succeeded', CallerIpAddress matching the machine running the command, Claims.upn matching the authenticated Azure CLI user.
- Test 2Delete Azure Policy Assignment via Azure CLI
Expected signal: Two AzureActivity entries: first with OperationNameValue='MICROSOFT.AUTHORIZATION/POLICYASSIGNMENTS/WRITE' (creation), second with OperationNameValue='MICROSOFT.AUTHORIZATION/POLICYASSIGNMENTS/DELETE' (deletion). Both with ActivityStatusValue='Succeeded'. The DELETE operation is the high-severity event that triggers alerting.
- Test 3Enable Unused Azure Region via Feature Registration
Expected signal: AzureActivity entry with OperationNameValue='MICROSOFT.FEATURES/PROVIDERS/FEATURES/REGISTER' or 'MICROSOFT.RESOURCES/PROVIDERS/REGISTER', ActivityStatusValue='Succeeded'. CallerIpAddress and Claims.upn identify the caller.
- Test 4Create Azure Policy Exemption to Bypass Security Control
Expected signal: AzureActivity entry with OperationNameValue='MICROSOFT.AUTHORIZATION/POLICYEXEMPTIONS/WRITE', ActivityStatusValue='Succeeded'. The exemption category (Waiver vs Mitigated), scope, and referenced policy assignment are captured in the Properties field.
References (9)
- https://attack.mitre.org/techniques/T1578/005/
- https://www.microsoft.com/en-us/security/blog/2023/07/25/cryptojacking-understanding-and-defending-against-cloud-compute-resource-abuse/
- https://learn.microsoft.com/en-us/azure/governance/policy/samples/built-in-policies#compute
- https://learn.microsoft.com/en-us/azure/azure-resource-manager/management/azure-subscription-service-limits
- https://learn.microsoft.com/en-us/rest/api/quota/quota/update
- https://learn.microsoft.com/en-us/azure/governance/policy/concepts/exemption-structure
- https://learn.microsoft.com/en-us/azure/azure-monitor/essentials/activity-log
- https://docs.splunk.com/Documentation/AddOns/released/MSCloudServices/About
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1578/T1578.md
Unlock Pro Content
Get the full detection package for T1578.005 including response playbook, investigation guide, and atomic red team tests.