Create Cloud Instance (T1578.002) is a sub-technique of Modify Cloud Compute Infrastructure in the defense impairment tactic, for IaaS. The adversary creates a new instance or virtual machine in the compute service of a cloud account to evade defenses.
How attackers use it
A new instance may let the adversary get around firewall rules and permissions on the instances already in the account. MITRE describes a typical chain: create snapshots (T1578.001) of one or more volumes, create a new instance, mount the snapshots, then apply a less restrictive security policy. The purpose can be to collect data from the local system (T1005) or for remote data staging (T1074.002).
MITRE adds that a new instance lets the adversary work inside the environment without disturbing the instances already running, so existing monitoring sees nothing odd on the original workloads.
How to detect it
MITRE's analytic points to:
- Instance creation by rarely used or newly created accounts
- Creation events from unusual geolocations
- A quick sequence of snapshot, instance creation and mount
- Unexpected network or IAM policy changes applied to the new instance, which suggest adversary use rather than normal provisioning
Context again does the work. Do you know the usual regions, the usual launch templates, and the identities that normally start instances? If so, the unusual one stands out.
Tie the audit log to your inventory. A new instance that is not in your infrastructure code, or not from your pipeline, is worth a look.
How to reduce the risk
- Audit. Routinely check user permissions so only expected identities can create instances.
- User account management. Limit instance creation to what each role needs. Keep few administrative IAM roles, trim permanent privileged assignments and review entitlements regularly.
Two useful extras that follow from the detection notes: restrict which regions can be used, and make the pipeline the normal path to create instances, so manual creation becomes the exception.
Check your own environment
# AWS CLI: instances with launch time, newest launches are easy to scan in the table
aws ec2 describe-instances --query 'Reservations[].Instances[].[InstanceId,LaunchTime,State.Name]' --output table
# AWS CLI: recent instance launch events from CloudTrail
aws cloudtrail lookup-events --lookup-attributes AttributeKey=EventName,AttributeValue=RunInstances --max-results 20
For Azure, az vm list and for Google Cloud, gcloud compute instances list give the same inventory view.
- Which identities can launch instances, and in which regions?
- Does every running instance map to infrastructure code or a known owner?
- Do new instances trigger a review when they carry permissive network rules?
Quick check
Why can a new instance hide activity?
It sits outside the firewall rules and permissions tied to existing instances, and it lets an adversary act without affecting workloads that are already running.
