An EBS snapshot block was downloaded

Analytics BIOC Informational

An EBS snapshot block was downloaded

An EBS snapshot block was downloaded using the EBS direct API. This may indicate an attacker's attempt to exfiltrate data from a volume snapshot in the cloud environment.

Module:: Cortex Cloud
Licensed by:: Cloud Runtime Security (CRS)
Data source:: AWS Audit Log

ATT&CK tactics: Collection (TA0009) Exfiltration (TA0010)

ATT&CK techniques: Data from Cloud Storage (T1530) Automated Exfiltration (T1020)

Detector tags: Cloud Data Asset Exfiltration Data Detection & Response

Attacker's goals:

Exfiltrate sensitive data from the cloud environment.

Investigative actions:

Check the accessed snapshot and corresponding volume. Monitor additional snapshot blocks downloads from the snapshot. Verify that the identity did not download any sensitive information that it shouldn't.

Test period:: N/A (single event)
Deduplication:: 1 Day

2 variations:

An EBS snapshot block was downloaded from a snapshot with sensitive data Medium (parent: Informational)
An unusual download of EBS snapshot block Low (parent: Informational)