T1578.005 — Modify Cloud Compute Configurations

Tactic: Defense Impairment · Platforms: IaaS

Adversaries may modify settings that directly affect the size, locations, and resources available to cloud compute infrastructure in order to evade defenses. These settings may include service quotas, subscription associations, tenant-wide policies, or other configurations that impact available…

Sub-technique of Modify Cloud Compute Infrastructure (T1578).

Sigma detection rules (1)

T1578.005 Modify Cloud Compute Infrastructure: Modify Cloud Compute Configurations

title: "T1578.005 Modify Cloud Compute Infrastructure: Modify Cloud Compute Configurations"
id: 6bdabe62-2f2c-42ca-b8e2-0c6f0a700902
description: 'Detection Strategy for Modify Cloud Compute Infrastructure: Modify Cloud Compute Configurations. (Retargeted to the cloudtrail AWS telemetry that actually captures this techniques behavior; see logsource below.) Tune using: UserContext, TimeWindow, ChangeType, GeoLocation.'
references:
  - https://attack.mitre.org/techniques/T1578/005
author: Shahrukh Khan
date: 2026-01-26
license: MIT
tags:
  - attack.defense-impairment
  - attack.t1578.005

logsource:
  category: cloudtrail
  product: aws

detection:
  selection:
    eventSource: 'ec2.amazonaws.com'
    eventName:
      - 'ModifyVpcAttribute'
      - 'ModifyLaunchTemplate'
      - 'ModifyDefaultCreditSpecification'

  condition: selection

falsepositives:
  - Planned infrastructure changes to VPC settings or launch template versions performed through standard change management.

level: medium

Related sub-techniques

Explore