{"id":"T1578.005","name":"Modify Cloud Compute Configurations","url":"https://attack.mitre.org/techniques/T1578/005","tactics":["defense-impairment"],"platforms":["IaaS"],"live":true,"revoked":false,"deprecated":false,"revoked_by":null,"detection_strategies":[{"id":"DET0492","stix_id":"x-mitre-detection-strategy--d4586276-d188-44e7-a782-dded12dd352e","name":"Detection Strategy for Modify Cloud Compute Infrastructure: Modify Cloud Compute Configurations","url":"https://attack.mitre.org/detectionstrategies/DET0492","analytics":[{"id":"AN1356","stix_id":"x-mitre-analytic--193f0293-0a53-430f-83c0-a69d0663479a","name":"Analytic 1356","description":"Defenders should monitor for anomalous or unauthorized changes to cloud compute configurations that alter quotas, tenant-wide policies, subscription associations, or allowed deployment regions. From a defender’s perspective, suspicious behavior chains include a sudden increase in compute quota requests followed by new instance or resource creation, policy modifications that weaken security restrictions, or enabling previously unused/unsupported cloud regions. Correlation across identity, configuration, and subsequent provisioning logs is critical to distinguish legitimate administrative activity from adversarial abuse.","url":"https://attack.mitre.org/detectionstrategies/DET0492#AN1356","platforms":["IaaS"],"log_source_references":[{"name":"AWS:CloudTrail","channel":"RequestServiceQuotaIncrease","data_component":"DC0069","data_component_name":"Cloud Service Modification","log_source_slug":"aws-cloudtrail"}],"mutable_elements":[{"field":"UserContext","description":"Identity performing the quota or configuration change; tuned to filter known admins or automation accounts."},{"field":"TimeWindow","description":"Correlation period for configuration change followed by resource creation; tuned to environment norms."},{"field":"ChangeType","description":"Type of configuration being modified (quota, policy, region); tuned to organization-specific risk thresholds."},{"field":"GeoLocation","description":"Region where the configuration change originates; tuned to enterprise’s expected operational geography."}],"live":true,"detection_strategies":["DET0492"],"techniques":["T1578.005"]}],"live":true,"version":"1.0","techniques":["T1578.005"]}],"sigma_rules":[],"kev_cves":[],"_built":"2026-08-23 05:47 UTC","_attack_version":"19.2","_sigma_commit":"da9bb07d642a2826e89702445d32c795209ec108"}