AN0861: Analytic 0861
Detection focuses on identifying unauthorized or anomalous changes to compute infrastructure components. Defender perspective: monitor for creation, deletion, or modification of instances, volumes, and snapshots outside of approved change management windows; correlate abnormal activity such as rapid snapshot creation followed by new instance mounts, or repeated infrastructure changes by rarely used accounts. Flagging activity linked to unusual geolocation, API client, or automation script is suspicious.
Analyst context for executives and security teams
AN0861 is a cloud infrastructure detection analytic for spotting unauthorized or unusual changes to IaaS compute components such as instances, volumes, and snapshots. For leaders, the value is not just alerting on a cloud API call; it is validating whether the organization can quickly distinguish approved infrastructure change from activity that could disrupt operations, expose data through snapshots, or indicate misuse of seldom-used accounts.
Executive priority
Prioritize this analytic where IaaS environments support critical services or regulated data. Executives should ask whether cloud infrastructure changes are tied to approved change windows, whether rarely used accounts are reviewed, and whether SOC and incident response teams can investigate unusual geolocation, API client, or automation-script activity. This supports operational resilience, cloud control assurance, and audit evidence around change management.
Technical view
For SOC, cloud security, and IR teams, validate monitoring for creation, deletion, and modification of IaaS instances, volumes, and snapshots. Tune detection around approved change management windows and expected automation. Investigate sequences such as rapid snapshot creation followed by new instance mounts, repeated changes by rarely used accounts, or infrastructure activity from unusual geolocation, API clients, or scripts. No ATT&CK tactic or relationship context is supplied, so local cloud architecture and change records are required to interpret severity.
Likely telemetry
- IaaS cloud control-plane/API activity logs
- Instance creation, deletion, and modification events
- Volume creation, deletion, attachment, detachment, and modification events
- Snapshot creation, deletion, sharing, and mount-related events where available
- Account identity and usage history, especially rarely used accounts
Detection direction
- Confirm that cloud API logging is enabled and retained for compute, volume, and snapshot operations.
- Correlate infrastructure changes with approved change windows rather than treating every change as suspicious.
- Baseline expected automation accounts, scripts, API clients, and deployment tools to reduce false positives.
- Flag repeated or high-velocity infrastructure changes by rarely used accounts for review.
- Look for suspicious sequences, especially rapid snapshot creation followed by new instance mounts.
Mitigation priorities
- Maintain enforceable change management for IaaS infrastructure changes and ensure SOC access to change records.
- Apply least privilege to accounts that can create, modify, delete, attach, or mount compute, volume, and snapshot resources.
- Review rarely used accounts and remove or restrict unnecessary infrastructure permissions.
- Standardize approved automation paths so unexpected scripts or API clients are easier to identify.
- Retain cloud control-plane logs long enough to support incident response and compliance evidence.
Analyst notes and limits
This object is a detection analytic for IaaS compute infrastructure change monitoring. The strongest decision value is in validating cloud control-plane visibility, change-management correlation, and identity context for accounts performing infrastructure operations.
The supplied ATT&CK fields do not include an official detection section, tactics, mitigations, procedures, or relationship context. This take therefore avoids attribution, active exploitation claims, impact assumptions, and platform claims beyond IaaS. Local cloud provider logs, asset criticality, and change-management data are required to operationalize the analytic.
Analytic 0861
Detection focuses on identifying unauthorized or anomalous changes to compute infrastructure components. Defender perspective: monitor for creation, deletion, or modification of instances, volumes, and snapshots outside of approved change management windows; correlate abnormal activity such as rapid snapshot creation followed by new instance mounts, or repeated infrastructure changes by rarely used accounts. Flagging activity linked to unusual geolocation, API client, or automation script is suspicious.
How security teams should use this page
Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.
All related ATT&CK context
No relationships are available in the current normalized data for this object.
Object version and sync metadata
The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates .
Imported snapshots across ATT&CK releases (1)
| Release | Bundle imported | Object version | Modified | Status | Raw hash |
|---|---|---|---|---|---|
| 19.1 | 1.0 | Current bundle | e471dd3881e7… |
Mirrored ATT&CK source object
The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.
External references and citations
MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.
-
[1]
mitre-attack AN0861Open source URL
Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.