An adversary may create a new instance or virtual machine (VM) within the compute service of a cloud account to evade defenses. Creating a new instance may allow an adversary to bypass firewall rules and permissions that exist on instances currently residing within an account. An adversary may [Create Snapshot](https://attack.mitre.org/techniques/T1578/001) of one or more volumes in an account, create a new instance, mount the snapshots, and then apply a less restrictive security policy to collect [Data from Local System](https://attack.mitre.org/techniques/T1005) or for [Remote Data Staging](https://attack.mitre.org/techniques/T1074/002).(Citation: Mandiant M-Trends 2020)

Creating a new instance may also allow an adversary to carry out malicious activity within an environment without affecting the execution of current running instances.
Create Cloud Instance
source_name: mitre-attack  url: https://attack.mitre.org/techniques/T1578/002  external_id: T1578.002     source_name: Mandiant M-Trends 2020  description: Mandiant. (2020, February). M-Trends 2020. Retrieved April 24, 2020.  url: https://content.fireeye.com/m-trends/rpt-m-trends-2020     source_name: AWS CloudTrail Search  description: Amazon. (n.d.). Search CloudTrail logs for API calls to EC2 Instances. Retrieved June 17, 2020.  url: https://aws.amazon.com/premiumsupport/knowledge-center/cloudtrail-search-api-calls/     source_name: Azure Activity Logs  description: Microsoft. (n.d.). View Azure activity logs. Retrieved June 17, 2020.  url: https://docs.microsoft.com/en-us/azure/azure-resource-manager/management/view-activity-logs     source_name: Cloud Audit Logs  description: Google. (n.d.). Audit Logs. Retrieved June 1, 2020.  url: https://cloud.google.com/logging/docs/audit#admin-activity     