T1578.002 — Create Cloud Instance

Tactic: Defense Impairment · Platforms: IaaS

An adversary may create a new instance or virtual machine (VM) within the compute service of a cloud account to evade defenses. Creating a new instance may allow an adversary to bypass firewall rules and permissions that exist on instances currently residing within an account. An adversary may…

Sub-technique of Modify Cloud Compute Infrastructure (T1578).

Sigma detection rules (1)

T1578.002 Modify Cloud Compute Infrastructure: Create Cloud Instance

title: "T1578.002 Modify Cloud Compute Infrastructure: Create Cloud Instance"
id: 118f02ba-dfe3-4def-bc54-156eb53c0c2e
description: 'Detection Strategy for Modify Cloud Compute Infrastructure: Create Cloud Instance. (Retargeted to the cloudtrail AWS telemetry that actually captures this techniques behavior; see logsource below.) Tune using: UserContext, GeoLocation, RateThreshold, TaggingPolicy.'
references:
  - https://attack.mitre.org/techniques/T1578/002
author: Shahrukh Khan
date: 2026-01-08
license: MIT
tags:
  - attack.defense-impairment
  - attack.t1578.002

logsource:
  category: cloudtrail
  product: aws

detection:
  selection:
    eventSource: 'ec2.amazonaws.com'
    eventName: 'RunInstances'

  condition: selection

falsepositives:
  - Instances launched without the standard Owner tag due to legacy automation scripts that predate the tagging policy.

level: medium

Related sub-techniques

Explore