EBS volume detachment attempt

Synopsis

Field	Value
Activation Period	14 Days
Training Period	30 Days
Test Period	N/A (single event)
Deduplication Period	5 Days
Required Data	AWS Audit Log
Detection Modules	Cloud
ATT&CK Tactic	Defense Impairment (TA0112)
ATT&CK Technique	Modify Cloud Compute Infrastructure (T1578)
Severity	Informational

Description

An attempt was made to detach an AWS EBS volume from an EC2 instance.

Attacker's Goals

Exfiltrate sensitive data stored on the detached volume.

Investigative actions

• Review recent activity related to the identity and the detached volume.

Variations

EBS volume detachment attempt using Cloud Formation or Terraform

Synopsis

Field	Value
ATT&CK Tactic	Defense Impairment (TA0112)
ATT&CK Technique	Modify Cloud Compute Infrastructure (T1578)
Severity	Informational

Description

An attempt was made to detach an AWS EBS volume from an EC2 instance.

Attacker's Goals

Exfiltrate sensitive data stored on the detached volume.

Investigative actions

• Review recent activity related to the identity and the detached volume.