Modify Cloud Compute Configurations (T1578.005) is a sub-technique of Modify Cloud Compute Infrastructure in the defense impairment tactic, for IaaS. The adversary changes settings that affect the size, locations and resources available to cloud compute, to evade defenses.
How attackers use it
MITRE lists settings such as service quotas, subscription associations, tenant-wide policies and other configurations that affect available compute. The change can let the adversary abuse the victim's compute resources, possibly without touching running instances or revealing themselves.
Three examples from MITRE:
- Quota increases. Providers limit usage with quotas, and customers can request adjustments, sometimes needing provider approval. An adversary who compromises an account can request an increase to support activity such as Resource Hijacking (T1496) without using up the victim's whole quota, which would draw attention.
- Policy changes. An adversary may modify tenant-wide policies that cap the size of deployed virtual machines.
- Region changes. Settings that control where resources may be deployed can be changed, for example enabling unused or unsupported cloud regions (T1535).
How to detect it
MITRE's analytic asks defenders to watch for changes to quotas, tenant-wide policies, subscription associations or allowed regions. Suspicious chains:
- A sudden quota increase request followed by new instance or resource creation
- Policy changes that weaken security restrictions
- Enabling a region that was never used before
Correlate identity, configuration and provisioning logs to separate real administration from abuse.
How to reduce the risk
- User account management. Limit permission to request quota changes or modify tenant-level compute settings to only those who need it.
- Audit. Routinely monitor who holds those permissions.
Check your own environment
# AWS CLI: EC2 service quotas for this account and region
aws service-quotas list-service-quotas --service-code ec2
# AWS CLI: history of quota increase requests
aws service-quotas list-requested-service-quota-change-history
# AWS CLI: regions and whether each is enabled
aws ec2 describe-regions --all-regions --query 'Regions[].[RegionName,OptInStatus]' --output table
- Who can request quota increases or change tenant policy?
- Do you know which regions your organization actually uses, and are the others blocked?
- Do quota changes create an alert and a ticket?
Quick check
Why would an attacker raise quotas instead of using the existing allowance?
To run more resource-heavy activity such as resource hijacking without consuming the victim's whole quota, which might raise suspicion.
