Skip to content

Hide Navigation Hide TOC

Instance Stop (1361e324-b594-4c0e-a517-20cee32b8d7f)

The deactivation or shutdown of a virtual machine instance within a cloud infrastructure. This action typically involves stopping a running instance, which halts its operation and releases certain associated resources, such as CPU and memory. Examples:

  • Google Cloud Platform (GCP): instance.stop events recorded in GCP Audit Logs indicate the deactivation of an instance.
  • Amazon Web Services (AWS): StopInstances actions in AWS CloudTrail indicate EC2 instances being stopped.
  • Microsoft Azure: Microsoft.Compute/virtualMachines/deallocate or stop events in Azure Activity Logs represent a virtual machine being stopped or deallocated.
Cluster A Galaxy A Cluster B Galaxy B Level
Modify Cloud Compute Infrastructure - T1578 (144e007b-e638-431d-a894-45d90c54ab90) Attack Pattern Instance Stop (1361e324-b594-4c0e-a517-20cee32b8d7f) mitre-data-component 1
Revert Cloud Instance - T1578.004 (0708ae90-d0eb-4938-9a76-d0fc94f6eec1) Attack Pattern Instance Stop (1361e324-b594-4c0e-a517-20cee32b8d7f) mitre-data-component 1
Modify Cloud Compute Infrastructure - T1578 (144e007b-e638-431d-a894-45d90c54ab90) Attack Pattern Revert Cloud Instance - T1578.004 (0708ae90-d0eb-4938-9a76-d0fc94f6eec1) Attack Pattern 2