Analytics Alerts

Browse the Cortex analytics alert reference.

Severity ▾
Detection module ▾
Data source ▾

1 alert match the current filters. tactic: TA0112 ✕ technique: T1578 ✕

Download CSV Show ATT&CK heatmap
  • EBS volume attachment attempt Informational Cloud 2 variations

    An attempt was made to attach an EBS volume to an EC2 instance.

    Activation:
    14 Days
    Training:
    30 Days
    Test:
    N/A (single event)
    Deduplication:
    5 Days
    ATT&CK tactics: Defense Impairment (TA0112)
    ATT&CK techniques: Modify Cloud Compute Infrastructure (T1578)
    Required data: AWS Audit Log
    Attacker's goals: Attach a volume to a cloud instance to exfiltrate sensitive data stored on EBS volumes.
    Investigative actions: Review recent activity related to the identity, the attached volume and the cloud instance.

    Variations

    EBS volume attachment attempt for volume with sensitive data

    Low overridden

    An attempt was made to attach an EBS volume with sensitive data to an EC2 instance. overridden

    EBS volume attachment attempt using Cloud Formation or Terraform

    Informational overridden

    An attempt was made to attach an EBS volume to an EC2 instance. overridden