Threat intelligence / Technique

Modify Cloud Compute Infrastructure

An adversary may attempt to modify a cloud account's compute service infrastructure to evade defenses. A modification to the compute service infrastructure can include the creation, deletion, or modification of one or more components such as compute instances, virtual machines, and snapshots. Permissions gained from the modification of infrastructure components may bypass restrictions that prevent access to existing infrastructure. Modifying infrastructure components may also allow an adversary to evade detection and remove evidence of their presence.(Citation: Mandiant M-Trends 2020)

Technique

TypeTechnique

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

An adversary may attempt to modify a cloud account's compute service infrastructure to evade defenses. A modification to the compute service infrastructure can include the creation, deletion, or modification of one or more components such as compute instances, virtual machines, and snapshots. Permissions gained from the modification of infrastructure components may bypass restrictions that prevent access to existing infrastructure. Modifying infrastructure components may also allow an adversary to evade detection and remove evidence of their presence.(Citation: Mandiant M-Trends 2020)

7 recorded

Relationships

mitigates

from Audit

Mitigation

mitigates

from User Account Management

Mitigation

subtechnique-of

from Create Cloud Instance

Technique

subtechnique-of

from Create Snapshot

Technique

subtechnique-of

from Delete Cloud Instance

Technique

subtechnique-of

from Modify Cloud Compute Configurations

Technique

subtechnique-of

from Revert Cloud Instance

Technique

2 external

References

mitre-attack

T1578

Mandiant M-Trends 2020

https://www.mandiant.com/sites/default/files/2021-09/mtrends-2020.pdf