Techniques › T1578.002 › AN1242
AN1242 Analytic 1242
IaaS · attack.mitre.org · ATT&CK Enterprise v19.2
<p>Detection focuses on abnormal or unauthorized cloud instance creation events. From a defender’s perspective, suspicious behavior includes VM/instance creation by rarely used or newly created accounts, creation events from unusual geolocations, or rapid sequences of snapshot creation followed by instance creation and mounting. Unexpected network or IAM policy changes applied to new instances can indicate adversarial use rather than legitimate provisioning.</p>
- Detects
- T1578.002 Create Cloud Instance
- Part of
- DET0449 Detection Strategy for Modify Cloud Compute Infrastructure: Create Cloud Instance
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| AWS:CloudTrail | RunInstances | DC0080 Instance Start |
| AWS:CloudTrail | DescribeInstances | DC0086 Instance Metadata |
| azure:activity | MICROSOFT.COMPUTE/VIRTUALMACHINES/WRITE | DC0076 Instance Creation |
Mutable elements
Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.
| Field | Description |
|---|---|
UserContext | IAM user, service account, or role creating the instance. Tuned to allowlist known automation services. |
GeoLocation | Region or source IP where the creation request originates. Helps detect cross-region or unusual location abuse. |
RateThreshold | Number of instances created per user or account in a time window. Tuned for environments with elastic scaling. |
TaggingPolicy | Expected tags (e.g., owner, purpose, cost center) for new instances. Deviations may indicate adversarial creation. |