Modification of Cloud Resources

The subject alters configuration, metadata, policies, or infrastructure settings within a cloud environment in a manner inconsistent with approved operations or without formal change control. These unauthorized modifications can disrupt security posture, affect service availability, or create covert channels for later misuse.

This behavior includes changes to identity and access policies (IAM), virtual private cloud (VPC) rules, auto-scaling groups, storage permissions, logging configurations, and workload definitions. Unlike overt deletion or creation events, modifications may appear routine and be harder to detect, especially when aligned with the subject's normal role or technical permissions.

Example scenarios:

• Downgrading or disabling encryption settings on cloud storage.
• Adding unauthorized IP ranges to firewall rules.
• Turning off audit logging or reducing retention periods.
• Modifying compute instance startup scripts to exfiltrate credentials or data.
• Changing IAM roles to expand access for themselves or others.

Such modifications may serve as preparation for subsequent actions (e.g., data exfiltration, credential harvesting) or be part of sabotage or boundary testing.