Delete Cloud Instance (T1578.003) is a sub-technique of Modify Cloud Compute Infrastructure in the defense impairment tactic, for IaaS. The adversary deletes a cloud instance after finishing their malicious activity, to evade detection and remove evidence.
How attackers use it
Deleting a VM that cannot be recovered removes valuable forensic artifacts. MITRE also notes an adversary may create a cloud instance (T1578.002) and terminate it later once their objectives are met. The instance is a disposable workspace.
How to detect it
MITRE's analytic correlates authentication, instance lifecycle and account activity. Behaviors of interest:
- Instances deleted shortly after creation
- Deletions by new or rarely used accounts
- Deletions that follow snapshot creation
- Deletions from unusual geolocations or access keys
The lesson for logging: the instance may be gone, so the evidence must live elsewhere. Cloud audit logs, flow logs and centrally collected host logs survive a deleted VM. Local disks do not.
How to reduce the risk
- User account management. Limit deletion permissions according to least privilege, keep administrative roles few, reduce permanent privileged assignments and review entitlements.
- Audit. Routinely check that only expected identities can delete instances.
Check your own environment
# AWS CLI: recent instance termination events from CloudTrail
aws cloudtrail lookup-events --lookup-attributes AttributeKey=EventName,AttributeValue=TerminateInstances --max-results 20
- Are logs shipped off the instance in near real time?
- Who can terminate instances, and is that limited by role?
- Do you alert when an instance lives for minutes and is then removed?
Quick check
Why does central logging matter for this technique?
A deleted instance takes its local forensic artifacts with it, so evidence must already exist in cloud audit logs and centrally collected host logs.
