An adversary may create a new instance or virtual machine (VM) within the compute service of a cloud account to evade defenses. Creating a new instance may allow an adversary to bypass firewall rules and permissions that exist on instances currently residing within an account. An adversary may [Create Snapshot](https://attack.mitre.org/techniques/T1578/001) of one or more volumes in an account, create a new instance, mount the snapshots, and then apply a less restrictive security policy to collect [Data from Local System](https://attack.mitre.org/techniques/T1005) or for [Remote Data Staging](https://attack.mitre.org/techniques/T1074/002).(Citation: Mandiant M-Trends 2020) Creating a new instance may also allow an adversary to carry out malicious activity within an environment without affecting the execution of current running instances.

Linked Issues

Issuelinks
Linktype Issue
is related to Techniques
is blocked by Detection Strategy for Modify Cloud Compute Infrastructure: Create Cloud Instance
is blocked by Audit
is blocked by User Account Management
is blocked by Access Restriction For Change
is blocked by Secure Baseline Configurations
is blocked by Continuous Monitoring
is blocked by Separation of Duties (SoD)
is blocked by Identification & Authentication for Organizational Users
is blocked by Identifier Management (User Names)
is blocked by Authenticator Feedback
is blocked by Account Management
is blocked by Access Enforcement
is blocked by Least Privilege
is blocked by Vulnerability Scanning
Impressum German English