Modify Cloud Compute Infrastructure: Create Cloud Instance

Threat Actors may create a new instance or virtual machine (VM) within the compute service of a cloud account to evade defenses. Creating a new instance may allow Threat Actors to bypass firewall rules and permissions that exist on instances currently residing within an account. Threat Actors may Create Snapshotof one or more volumes in an account, create a new instance, mount the snapshots, and then apply a less restrictive security policy to collect Data from Local System or for Remote Data Staging.