Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
ATT&CK technique

T1578.005

Modify Cloud Compute Configurations

Defense Impairment 20 detections found
View on MITRE ATT&CK →

Detection rules

Source Rule Status Updated
splunk AWS EC2 Startup Script Modified on Stopped Instance production 2026-10-07
elastic AWS EC2 Serial Console Access Enabled production 2026-09-18
elastic AWS Lambda Layer Added to Existing Function production 2026-09-18
elastic AWS Lambda Layer Shared Externally production 2026-09-18
elastic AWS EC2 Encryption Disabled production 2026-09-18
elastic AWS EC2 EBS Snapshot Access Removed production 2026-09-18
elastic AWS RDS DB Instance or Cluster Deletion Protection Disabled production 2026-09-18
elastic AWS EC2 Network Access Control List Creation production 2026-09-18
elastic AWS EC2 Route Table Modified or Deleted production 2026-09-18
elastic AWS EC2 Security Group Configuration Change production 2026-09-18
elastic AWS Lambda Function Policy Updated to Allow Cross-Account Invocation production 2026-09-18
elastic AWS Lambda Event Source Mapping Creation production 2026-09-18
elastic AWS Lambda Function URL Created with Public Access production 2026-09-18
elastic AWS EC2 Route Table Created production 2026-09-18
elastic Azure Key Vault Modified production 2026-09-18
elastic GCP Storage Bucket Configuration Modification production 2026-09-18
elastic GCP Virtual Private Cloud Route Creation production 2026-09-18
elastic GCP Virtual Private Cloud Route Deletion production 2026-09-18
elastic AWS Lambda Function Policy Updated to Allow Public Invocation production 2026-09-18
splunk Cloud Security Groups Modifications by User production 2026-05-13