Instance Start (f8213cde-6b3a-420d-9ab7-41c9af1a919f)

Activation or invocation of an instance (ex: instance.start within GCP Audit Logs)

Cluster A	Galaxy A	Cluster B	Galaxy B	Level
User Execution - T1204 (8c32eb4d-805f-4fc5-bf60-c4d476c131b5)	Attack Pattern	Instance Start (f8213cde-6b3a-420d-9ab7-41c9af1a919f)	mitre-data-component	1
Modify Cloud Compute Infrastructure - T1578 (144e007b-e638-431d-a894-45d90c54ab90)	Attack Pattern	Instance Start (f8213cde-6b3a-420d-9ab7-41c9af1a919f)	mitre-data-component	1
Instance Start (f8213cde-6b3a-420d-9ab7-41c9af1a919f)	mitre-data-component	Malicious Image - T1204.003 (b0c74ef9-c61e-4986-88cb-78da98a355ec)	Attack Pattern	1
Instance Start (f8213cde-6b3a-420d-9ab7-41c9af1a919f)	mitre-data-component	Revert Cloud Instance - T1578.004 (0708ae90-d0eb-4938-9a76-d0fc94f6eec1)	Attack Pattern	1
User Execution - T1204 (8c32eb4d-805f-4fc5-bf60-c4d476c131b5)	Attack Pattern	Malicious Image - T1204.003 (b0c74ef9-c61e-4986-88cb-78da98a355ec)	Attack Pattern	2
Modify Cloud Compute Infrastructure - T1578 (144e007b-e638-431d-a894-45d90c54ab90)	Attack Pattern	Revert Cloud Instance - T1578.004 (0708ae90-d0eb-4938-9a76-d0fc94f6eec1)	Attack Pattern	2