Cloud snapshot of a database or storage instance was publicly shared

Analytics BIOC Medium

Cloud snapshot of a database or storage instance was publicly shared

A cloud identity has publicly shared a snapshot of a database or storage instance.

Module:: Cortex Cloud
Licensed by:: Cloud Runtime Security (CRS)
Data source:: AWS Audit Log

ATT&CK tactics: Exfiltration (TA0010)

ATT&CK techniques: Transfer Data to Cloud Account (T1537)

Detector tags: Cloud Data Asset Exfiltration Cloud Data Asset Public Exposure Data Detection & Response

Attacker's goals:

Exfiltrate sensitive data that resides on the snapshot.

Investigative actions:

Check if the identity intended to share the snapshot publicly. Check if the identity performed additional malicious operations within the cloud environment.

Test period:: N/A (single event)
Deduplication:: 5 Days