Detect Modify Cloud Compute Infrastructure in Splunk
This detection identifies adversary attempts to modify cloud compute infrastructure components — including creating, deleting, or reverting virtual machines, snapshots, and compute configurations — to bypass access controls, evade detection, or erase forensic evidence. The KQL query monitors Azure Activity logs for anomalous compute operations such as snapshot creation from running instances, instance deletion outside approved maintenance windows, and configuration changes to security-relevant VM properties. The SPL query targets AWS CloudTrail events for equivalent actions across EC2, EBS, and related compute services. High-privilege cloud principals performing bulk or unusual compute operations are the primary focus, particularly when those operations originate from unfamiliar IP addresses or occur outside normal change windows.
MITRE ATT&CK
- Tactic
- Defense Evasion
- Canonical reference
- https://attack.mitre.org/techniques/T1578/
SPL Detection Query
index=* sourcetype="aws:cloudtrail"
| search eventSource="ec2.amazonaws.com" OR eventSource="compute.amazonaws.com"
| search eventName IN (
"RunInstances", "TerminateInstances", "StopInstances",
"CreateSnapshot", "DeleteSnapshot", "CopySnapshot",
"CreateImage", "DeregisterImage", "DeleteImage",
"ModifyInstanceAttribute", "ModifySnapshotAttribute",
"CreateVolume", "DeleteVolume", "ModifyVolume",
"AssociateIamInstanceProfile", "ReplaceIamInstanceProfileAssociation",
"CreateInstanceExportTask", "ImportInstance"
)
| spath input=userIdentity output=principalId path=arn
| spath input=userIdentity output=principalType path=type
| spath input=userIdentity output=accountId path=accountId
| eval sourceIP = coalesce(sourceIPAddress, "unknown")
| eval region = awsRegion
| eval riskScore = case(
eventName IN ("TerminateInstances", "DeleteSnapshot", "DeregisterImage", "DeleteImage", "DeleteVolume"), 3,
eventName IN ("CreateImage", "CreateSnapshot", "CopySnapshot", "CreateInstanceExportTask", "ImportInstance"), 3,
eventName IN ("AssociateIamInstanceProfile", "ReplaceIamInstanceProfileAssociation", "ModifyInstanceAttribute"), 2,
1
)
| eval isSuspicious = case(
match(sourceIP, "^(10\.|172\.(1[6-9]|2[0-9]|3[01])\.|192\.168\.)"), 0,
errorCode="AccessDenied", 1,
1=1, 0
)
| stats
sum(riskScore) as totalRisk,
count as opCount,
dc(requestParameters.instanceId) as uniqueInstances,
values(eventName) as operations,
values(region) as regions,
values(requestParameters.snapshotId) as snapshots,
min(_time) as firstSeen,
max(_time) as lastSeen
by principalId, sourceIP, accountId
| where totalRisk >= 4 OR (opCount >= 6 AND uniqueInstances >= 3)
| eval alertSeverity = case(
totalRisk >= 9, "CRITICAL",
totalRisk >= 6, "HIGH",
totalRisk >= 3, "MEDIUM",
"LOW"
)
| eval alertReason = case(
totalRisk >= 9, "Critical: mass compute infrastructure modification including destructive actions",
totalRisk >= 6 AND match(mvjoin(operations, " "), "(Terminate|Delete|Deregister)"), "High-risk: destructive compute ops with export/imaging activity",
opCount >= 6, "Bulk compute operations across multiple instances by single principal",
"Elevated cloud compute infrastructure modification activity"
)
| table firstSeen, lastSeen, principalId, sourceIP, accountId, regions, opCount, totalRisk, alertSeverity, alertReason, operations, snapshots
| sort - totalRiskMonitors AWS CloudTrail for anomalous EC2 compute infrastructure modifications by a single IAM principal. Scores events by destructiveness and exfiltration potential (terminate/delete/export/import=3pts, IAM profile changes/attribute modification=2pts, creates=1pt) and alerts when cumulative score reaches 4 or bulk operations span 3+ unique instances. Covers instance lifecycle, snapshot operations, AMI management, volume manipulation, and IAM profile association changes.
Data Sources
Required Sourcetypes
False Positives & Tuning
- Automated scaling events from AWS Auto Scaling Groups triggering RunInstances/TerminateInstances at high volume during traffic spikes
- Backup and disaster recovery solutions (AWS Backup, Veeam) creating scheduled snapshots and AMIs across production fleets
- Infrastructure automation pipelines (Terraform, Ansible, AWS CDK) performing bulk creates and terminates during blue/green deployments
- AWS Spot Instance interruptions triggering mass TerminateInstances events from AWS service principals
- Security compliance tooling scanning and modifying instance attributes to enforce organizational policy baselines
Other platforms for T1578
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1AWS - Create and Share EC2 Snapshot Cross-Account
Expected signal: AWS CloudTrail events: CreateSnapshot (ec2.amazonaws.com), ModifySnapshotAttribute with createVolumePermission add — both visible in CloudTrail within 5-15 minutes
- Test 2Azure - Create VM Snapshot and Capture VM Image
Expected signal: AzureActivity log entries: Microsoft.Compute/snapshots/write (Succeeded), Microsoft.Compute/virtualMachines/capture/action (Started/Succeeded) — visible in Azure Monitor within 2-5 minutes
- Test 3AWS - Terminate Running EC2 Instance (Evidence Destruction)
Expected signal: AWS CloudTrail events: RunInstances (ec2.amazonaws.com) followed by TerminateInstances — both visible within 5-15 minutes. Instance state change to 'shutting-down' then 'terminated' visible in EC2 describe-instances.
References (9)
- https://attack.mitre.org/techniques/T1578/
- https://www.mandiant.com/resources/reports/m-trends-2020
- https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/monitor-with-cloudtrail.html
- https://docs.microsoft.com/en-us/azure/azure-monitor/essentials/activity-log
- https://attack.mitre.org/techniques/T1578/001/
- https://attack.mitre.org/techniques/T1578/002/
- https://attack.mitre.org/techniques/T1578/003/
- https://attack.mitre.org/techniques/T1578/004/
- https://attack.mitre.org/techniques/T1578/005/
Unlock Pro Content
Get the full detection package for T1578 including response playbook, investigation guide, and atomic red team tests.