DC0089 Instance Stop
| Item | Value |
|---|---|
| ID | DC0089 |
| Version | 2.0 |
| Created | 20 October 2021 |
| Last Modified | 21 October 2025 |
Log Sources
| Name | Channel |
|---|---|
| AWS:CloudTrail | TerminateInstances |
| AWS:CloudTrail | StopInstances |
Detection Strategy
| ID | Name | Technique Detected |
|---|---|---|
| DET0304 | Detection Strategy for Endpoint DoS via Application or System Exploitation | T1499.004 |
| DET0308 | Detection Strategy for Modify Cloud Compute Infrastructure | T1578 |
| DET0084 | Detection Strategy for Modify Cloud Compute Infrastructure: Delete Cloud Instance | T1578.003 |
| DET0337 | Detection Strategy for Modify Cloud Compute Infrastructure: Revert Cloud Instance | T1578.004 |