ATT&CK technique
View on MITRE ATT&CK →
T1578.002
Create Cloud Instance
Defense Impairment
3 detections found
Detection rules
| Source | Rule | Status | Updated |
|---|---|---|---|
| splunk | Cloud Compute Instance Created With Previously Unseen Instance Type | production | 2026-09-22 |
| elastic | AWS RDS DB Instance Restored | production | 2026-09-18 |
| elastic | Azure VM Extension Deployment by User | production | 2026-09-18 |