EBS snapshots were created from an EC2 instance

Synopsis

Field	Value
Activation Period	14 Days
Training Period	30 Days
Test Period	N/A (single event)
Deduplication Period	1 Day
Required Data	AWS Audit Log
Detection Modules	Cloud
ATT&CK Tactic	Collection (TA0009)
ATT&CK Technique	Data from Cloud Storage (T1530)
Severity	Informational

Description

One or more EBS snapshots were created from an EC2 instance.

Attacker's Goals

• Clone existing compute volumes for exfiltration purposes.
• This action may be a preliminary action before downloading snapshot blocks or creating volumes from the snapshots.

Investigative actions

• Confirm that the identity intended to create the described snapshots.
• Monitor the source instance for additional suspicious activities.
• Follow further actions done by the identity.

Variations

EBS snapshots were created from an EC2 instance attached one or more volumes with sensitive data

Synopsis

Field	Value
ATT&CK Tactic	Collection (TA0009)
ATT&CK Technique	Data from Cloud Storage (T1530)
Severity	Low

Description

One or more EBS snapshots were created from an EC2 instance. The instance has one or more volumes attached containing sensitive data.

Attacker's Goals

• Clone existing compute volumes for exfiltration purposes.
• This action may be a preliminary action before downloading snapshot blocks or creating volumes from the snapshots.

Investigative actions

• Confirm that the identity intended to create the described snapshots.
• Monitor the source instance for additional suspicious activities.
• Follow further actions done by the identity.

An unusual creation of EBS snapshots from an EC2 instances

Synopsis

Field	Value
ATT&CK Tactic	Collection (TA0009)
ATT&CK Technique	Data from Cloud Storage (T1530)
Severity	Low

Description

One or more EBS snapshots were created from an EC2 instance. The operation was not performed by this identity in the last 30 days.

Attacker's Goals

• Clone existing compute volumes for exfiltration purposes.
• This action may be a preliminary action before downloading snapshot blocks or creating volumes from the snapshots.

Investigative actions

• Confirm that the identity intended to create the described snapshots.
• Monitor the source instance for additional suspicious activities.
• Follow further actions done by the identity.