Techniques › T1578.005 › AN1356
AN1356 Analytic 1356
IaaS · attack.mitre.org · ATT&CK Enterprise v19.2
<p>Defenders should monitor for anomalous or unauthorized changes to cloud compute configurations that alter quotas, tenant-wide policies, subscription associations, or allowed deployment regions. From a defender’s perspective, suspicious behavior chains include a sudden increase in compute quota requests followed by new instance or resource creation, policy modifications that weaken security restrictions, or enabling previously unused/unsupported cloud regions. Correlation across identity, configuration, and subsequent provisioning logs is critical to distinguish legitimate administrative activity from adversarial abuse.</p>
- Detects
- T1578.005 Modify Cloud Compute Configurations
- Part of
- DET0492 Detection Strategy for Modify Cloud Compute Infrastructure: Modify Cloud Compute Configurations
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| AWS:CloudTrail | RequestServiceQuotaIncrease | DC0069 Cloud Service Modification |
Mutable elements
Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.
| Field | Description |
|---|---|
UserContext | Identity performing the quota or configuration change; tuned to filter known admins or automation accounts. |
TimeWindow | Correlation period for configuration change followed by resource creation; tuned to environment norms. |
ChangeType | Type of configuration being modified (quota, policy, region); tuned to organization-specific risk thresholds. |
GeoLocation | Region where the configuration change originates; tuned to enterprise’s expected operational geography. |