MITRE ATT&CK Technique
T1578Modify Cloud Compute Infrastructure
- First Reported
- Jun 26, 2026
- Latest Reported
- Sep 2, 2026
Official Description
An adversary may attempt to modify a cloud account's compute service infrastructure to evade defenses. A modification to the compute service infrastructure can include the creation, deletion, or modification of one or more components such as compute instances, virtual machines, and snapshots.
Permissions gained from the modification of infrastructure components may bypass restrictions that prevent access to existing infrastructure. Modifying infrastructure components may also allow an adversary to evade detection and remove evidence of their presence.(Citation: Mandiant M-Trends 2020)
Permissions gained from the modification of infrastructure components may bypass restrictions that prevent access to existing infrastructure. Modifying infrastructure components may also allow an adversary to evade detection and remove evidence of their presence.(Citation: Mandiant M-Trends 2020)
- Tactics
- Defense Impairment
- Platforms
- IaaS
- MITRE Version
- 2.0
- Last Modified
- May 12, 2026
Sub-techniques (5)
Reported Context (2)
- The article maps CI/CD pipeline activity and attempted cloud provisioning tool edits to Modify Cloud Compute Infrastructure. Human Attacker Used AI Agents to Intrude Into Enterprise Network in Under 10 Hours
- The operator modified security groups, staged EC2 instances, and attached security groups to database clusters. Shai Hulud-Linked Intrusion Escalated From Jenkins Credentials to AWS Redshift Data Theft
Malware (3)
Threat Actors (1)
MITRE ATT&CK (14)
Vendors (2)
Products (9)
Tools (4)
Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.