Analytics BIOC
Informational
✕
An AWS EC2 instance was exported into an unknown S3 bucket
An EC2 instance was exported to an unknown S3 bucket.
- Module:
- Cortex Cloud
- Licensed by:
- Cloud Runtime Security (CRS)
- Data source:
- AWS Audit Log
ATT&CK tactics: Exfiltration (TA0010)
ATT&CK techniques: Transfer Data to Cloud Account (T1537)
Detector tags: Cloud Data Asset Stealth Tactics Data Detection & Response
Attacker's goals:
An attack may exfiltrate data from an EC2 instance to an S3 bucket outside the account.
Investigative actions:
Check the identity that exported the instance. Check to which S3 bucket the EC2 was exported into. Check the S3 bucket permission and policy.
- Test period:
- N/A (single event)
- Deduplication:
- 3 Days