T1578.004 — Revert Cloud Instance

Tactic: Defense Impairment · Platforms: IaaS

An adversary may revert changes made to a cloud instance after they have performed malicious activities in attempt to evade detection and remove evidence of their presence. In highly virtualized environments, such as cloud-based infrastructure, this may be accomplished by restoring virtual machine…

Sub-technique of Modify Cloud Compute Infrastructure (T1578).

Sigma detection rules (1)

T1578.004 Modify Cloud Compute Infrastructure: Revert Cloud Instance

title: "T1578.004 Modify Cloud Compute Infrastructure: Revert Cloud Instance"
id: db730909-7491-4970-9284-2d8e4b063d7f
description: 'Detection Strategy for Modify Cloud Compute Infrastructure: Revert Cloud Instance. (Retargeted to the cloudtrail AWS telemetry that actually captures this techniques behavior; see logsource below.) Tune using: UserContext, TimeWindow, GeoLocation, ChangeTags.'
references:
  - https://attack.mitre.org/techniques/T1578/004
author: Shahrukh Khan
date: 2026-06-09
license: MIT
tags:
  - attack.defense-impairment
  - attack.t1578.004

logsource:
  category: cloudtrail
  product: aws

detection:
  selection:
    eventSource: 'ec2.amazonaws.com'
    eventName:
      - 'ModifyInstanceAttribute'
      - 'ModifyInstanceMetadataOptions'

  condition: selection

falsepositives:
  - Administrators hardening instance metadata service settings, such as enforcing IMDSv2, as part of routine security remediation.

level: medium

Related sub-techniques

Explore