Analytics BIOC Informational

EBS snapshots were created from an EC2 instance

One or more EBS snapshots were created from an EC2 instance.

Module:
Cortex Cloud
Licensed by:
Cloud Runtime Security (CRS)
Data source:
AWS Audit Log
ATT&CK tactics: Collection (TA0009)
ATT&CK techniques: Data from Cloud Storage (T1530)
Attacker's goals:

Clone existing compute volumes for exfiltration purposes. This action may be a preliminary action before downloading snapshot blocks or creating volumes from the snapshots.

Investigative actions:

Confirm that the identity intended to create the described snapshots. Monitor the source instance for additional suspicious activities. Follow further actions done by the identity.

Test period:
N/A (single event)
Deduplication:
1 Day
2 variations:
  • EBS snapshots were created from an EC2 instance attached one or more volumes with sensitive data Low (parent: Informational)
  • An unusual creation of EBS snapshots from an EC2 instances Low (parent: Informational)