T1578.004sub-technique of T1578 Modify Cloud Compute Infrastructure

Revert Cloud Instance

IaaSnothing on this site yetT1578.004 on attack.mitre.org

An adversary may revert changes made to a cloud instance after they have performed malicious activities in attempt to evade detection and remove evidence of their presence. In highly virtualized environments, such as cloud-based infrastructure, this may be accomplished by restoring virtual machine (VM) or data storage snapshots through the cloud management dashboard or cloud APIs.
MITRE ATT&CK 19.2, retrieved 2026-09-12

If this is happening now

Checklists and playbooks to open while the alert is still live.

Playbook for this stage

Ransomware, suspected or confirmed

Files renamed or unreadable, a ransom note, or backup deletion commands seen.

how MITRE says to see it

Detection Strategy for Modify Cloud Compute Infrastructure: Revert Cloud Instance

Defenders can detect suspicious reversion of cloud compute instances by monitoring for unusual snapshot restores, rollback actions, or ephemeral storage resets that occur outside expected administrative workflows.

the rest of T1578

T1578.001 Create Snapshot · not covered yet
T1578.002 Create Cloud Instance · not covered yet
T1578.003 Delete Cloud Instance · not covered yet
T1578.005 Modify Cloud Compute Configurations · not covered yet

The description, detection analytics and mitigations are reproduced from MITRE ATT&CK, version 19.2, under its terms of use. The checklists, hunts, labs and everything else linked here are this site’s.