Cloud compute volume creation attempt
Synopsis
Field
Value
Activation Period
14 Days
Training Period
30 Days
Test Period
N/A (single event)
Deduplication Period
5 Days
Required Data
AWS Audit Log
Detection Modules
Cloud
ATT&CK Tactic
Collection (TA0009), Defense Impairment (TA0112)
ATT&CK Technique
Modify Cloud Compute Infrastructure (T1578), Data from Cloud Storage (T1530)
Severity
Informational
Description
An attempt was made to create an EBS volume.
Attacker's Goals
Exfiltrate sensitive data stored on snapshots.
Investigative actions
Review recent activity related to the identity, the created volume and the cloud snapshot.
Variations
Was this helpful?