type: x-mitre-data-component
spec_version: 2.1
id: x-mitre-data-component--e52d89f9-1710-4708-88a5-cbef77c4cd5e
created: 2021-10-20T15:05:19.274Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/datacomponents/DC0069
external_id: DC0069
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-11-12T22:03:39.105Z
name: Cloud Service Modification
description: Cloud service modification refers to changes made to the configuration, settings, or data of a cloud service. These modifications can include administrative changes such as enabling or disabling features, altering permissions, or deleting critical components. Monitoring these changes is critical to detect potential misconfigurations or malicious activity. Examples: 

- AWS Cloud Service Modifications: A user disables AWS CloudTrail logging (StopLogging) or deletes a CloudWatch configuration rule (DeleteConfigRule).
- Azure Cloud Service Modifications: Changes to Azure Role-Based Access Control (RBAC) roles, such as adding a new Contributor role to a sensitive resource.
- Google Cloud Service Modifications: Deletion of a Google Cloud Storage bucket or disabling a Google Cloud Function.
- Office 365 Cloud Service Modifications: Altering mailbox permissions or disabling auditing in Microsoft 365.
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 2.0
x_mitre_attack_spec_version: 3.3.0
x_mitre_log_sources: name: AWS:CloudTrail
channel: CreateFunction
name: m365:unified
channel: Creation of Power Automate flow triggered by OneDrive or Exchange event
name: AWS:CloudTrail
channel: PutUserPolicy, PutGroupPolicy, PutRolePolicy, CreatePolicyVersion
name: AWS:CloudTrail
channel: Condition block updated in IAM policy (e.g., aws:SourceIp, aws:RequestedRegion)
name: azure:activity
channel: operationName: Write, Access Review, RoleAssignment
name: azure:policy
channel: UpdatePolicy
name: AWS:CloudTrail
channel: UpdateAccountPasswordPolicy
name: AWS:CloudTrail
channel: PutIdentityPolicy
name: AWS:CloudTrail
channel: LeaveOrganization: API calls severing accounts from AWS Organizations
name: AWS:CloudTrail
channel: CreateAccount: API calls creating new accounts in AWS Organizations
name: azure:audit
channel: Tenant subscription transfers or new management group creation
name: AWS:CloudTrail
channel: UpdateIdentityPolicy or DisableMFA
name: m365:unified
channel: SendMessage
name: gcp:config
channel: UpdateSink request modifying log export destinations
name: azure:policy
channel: DisableAuditLogs or ConditionalAccess logging changes
name: AWS:CloudTrail
channel: UpdateFederationSettings or RegisterHybridConnector
name: AWS:CloudTrail
channel: CreateTrafficMirrorSession / ModifyTrafficMirrorTarget
name: azure:activity
channel: Microsoft.Network/networkWatchers/flowLogSettings/write
name: gcp:audit
channel: compute.packetMirroring.insert
name: AWS:CloudTrail
channel: CreateFunction / UpdateFunctionConfiguration: Function creation, role assignment, or configuration change events
name: m365:unified
channel: AddFlow / UpdateFlow: New automation or workflow creation events
name: saas:appsscript
channel: Create / Update: Deployment of scripts with event-driven triggers
name: saas:slack
channel: Exported file or accessed admin API
name: AWS:CloudTrail
channel: RequestServiceQuotaIncrease
name: azure:activity
channel: MICROSOFT.AUTHORIZATION/POLICIES/WRITE
name: gcp:audit
channel: projects.updateQuota or orgPolicies.updatePolicy
name: AWS:CloudTrail
channel: Delete* / Stop*: DeleteAlarms, StopLogging, or DisableMonitoring API calls
name: AWS:CloudTrail
channel: Use of temporary credentials issued from IMDS access
name: saas:github
channel: Workflow triggered via pull_request_target from forked repo
name: azure:audit
channel: Consent to application: OAuth application consent granted to service principal
name: saas:integration
channel: New or modified third-party application integrations with elevated permissions