Detect Modify Cloud Compute Infrastructure in Microsoft Sentinel
This detection identifies adversary attempts to modify cloud compute infrastructure components — including creating, deleting, or reverting virtual machines, snapshots, and compute configurations — to bypass access controls, evade detection, or erase forensic evidence. The KQL query monitors Azure Activity logs for anomalous compute operations such as snapshot creation from running instances, instance deletion outside approved maintenance windows, and configuration changes to security-relevant VM properties. The SPL query targets AWS CloudTrail events for equivalent actions across EC2, EBS, and related compute services. High-privilege cloud principals performing bulk or unusual compute operations are the primary focus, particularly when those operations originate from unfamiliar IP addresses or occur outside normal change windows.
MITRE ATT&CK
- Tactic
- Defense Evasion
- Canonical reference
- https://attack.mitre.org/techniques/T1578/
KQL Detection Query
AzureActivity
| where TimeGenerated >= ago(1d)
| where ResourceProviderValue =~ "Microsoft.Compute"
| where OperationNameValue has_any (
"Microsoft.Compute/virtualMachines/write",
"Microsoft.Compute/virtualMachines/delete",
"Microsoft.Compute/snapshots/write",
"Microsoft.Compute/snapshots/delete",
"Microsoft.Compute/disks/write",
"Microsoft.Compute/disks/delete",
"Microsoft.Compute/virtualMachines/deallocate/action",
"Microsoft.Compute/virtualMachines/generalize/action",
"Microsoft.Compute/virtualMachines/capture/action",
"Microsoft.Compute/virtualMachines/extensions/write",
"Microsoft.Compute/virtualMachineScaleSets/write",
"Microsoft.Compute/virtualMachineScaleSets/delete",
"Microsoft.Compute/restorePointCollections/write"
)
| where ActivityStatusValue in~ ("Succeeded", "Started")
| extend CallerIp = tostring(CallerIpAddress)
| extend PrincipalName = tostring(Caller)
| extend OperationType = case(
OperationNameValue has "delete", "DELETE",
OperationNameValue has "/write", "CREATE_OR_MODIFY",
OperationNameValue has "capture", "CAPTURE",
OperationNameValue has "generalize", "GENERALIZE",
OperationNameValue has "deallocate", "DEALLOCATE",
OperationNameValue has "extension", "EXTENSION_CHANGE",
"OTHER"
)
| extend RiskScore = case(
OperationType == "DELETE", 3,
OperationType == "CAPTURE", 3,
OperationType == "GENERALIZE", 3,
OperationType == "EXTENSION_CHANGE", 2,
OperationType == "CREATE_OR_MODIFY", 1,
0
)
| summarize
OperationCount = count(),
UniqueResources = dcount(ResourceId),
OperationTypes = make_set(OperationType),
TotalRiskScore = sum(RiskScore),
FirstSeen = min(TimeGenerated),
LastSeen = max(TimeGenerated),
Resources = make_set(ResourceId, 10)
by PrincipalName, CallerIp, ResourceGroup, SubscriptionId
| where TotalRiskScore >= 3 or (OperationCount >= 5 and UniqueResources >= 3)
| extend AlertReason = case(
TotalRiskScore >= 6, "High-risk compute operations: multiple delete/capture/generalize actions",
TotalRiskScore >= 3 and OperationCount >= 5, "Elevated compute modification activity with destructive operations",
OperationCount >= 5 and UniqueResources >= 3, "Bulk modifications across multiple compute resources",
"Suspicious compute infrastructure modification"
)
| project
FirstSeen,
LastSeen,
PrincipalName,
CallerIp,
ResourceGroup,
SubscriptionId,
OperationCount,
UniqueResources,
OperationTypes,
TotalRiskScore,
AlertReason,
Resources
| sort by TotalRiskScore desc, OperationCount descMonitors Azure Activity logs for anomalous compute infrastructure modifications by a single principal. Scores operations by risk (DELETE/CAPTURE/GENERALIZE=3pts, EXTENSION_CHANGE=2pts, CREATE/MODIFY=1pt) and alerts when cumulative risk score reaches 3 or bulk modifications occur across 3+ resources. Covers VM lifecycle operations, snapshot creation/deletion, disk manipulation, generalization, capture, extension changes, and scale set modifications.
Data Sources
Required Tables
False Positives & Tuning
- Legitimate DevOps CI/CD pipelines creating and deleting ephemeral build VMs during automated deployment workflows
- Authorized disaster recovery tests involving snapshot creation, VM replication, and failover exercises
- Infrastructure-as-Code tooling (Terraform, Bicep, ARM templates) running bulk creates/deletes during planned maintenance windows
- Cloud cost optimization scripts automatically deallocating idle VMs on a schedule
- Security scanning tools or backup agents installing VM extensions across a fleet
Other platforms for T1578
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1AWS - Create and Share EC2 Snapshot Cross-Account
Expected signal: AWS CloudTrail events: CreateSnapshot (ec2.amazonaws.com), ModifySnapshotAttribute with createVolumePermission add — both visible in CloudTrail within 5-15 minutes
- Test 2Azure - Create VM Snapshot and Capture VM Image
Expected signal: AzureActivity log entries: Microsoft.Compute/snapshots/write (Succeeded), Microsoft.Compute/virtualMachines/capture/action (Started/Succeeded) — visible in Azure Monitor within 2-5 minutes
- Test 3AWS - Terminate Running EC2 Instance (Evidence Destruction)
Expected signal: AWS CloudTrail events: RunInstances (ec2.amazonaws.com) followed by TerminateInstances — both visible within 5-15 minutes. Instance state change to 'shutting-down' then 'terminated' visible in EC2 describe-instances.
References (9)
- https://attack.mitre.org/techniques/T1578/
- https://www.mandiant.com/resources/reports/m-trends-2020
- https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/monitor-with-cloudtrail.html
- https://docs.microsoft.com/en-us/azure/azure-monitor/essentials/activity-log
- https://attack.mitre.org/techniques/T1578/001/
- https://attack.mitre.org/techniques/T1578/002/
- https://attack.mitre.org/techniques/T1578/003/
- https://attack.mitre.org/techniques/T1578/004/
- https://attack.mitre.org/techniques/T1578/005/
Unlock Pro Content
Get the full detection package for T1578 including response playbook, investigation guide, and atomic red team tests.