Analytics BIOC
Informational
✕
EBS snapshots were created from an EC2 instance
One or more EBS snapshots were created from an EC2 instance.
- Module:
- Cortex Cloud
- Licensed by:
- Cloud Runtime Security (CRS)
- Data source:
- AWS Audit Log
ATT&CK tactics: Collection (TA0009)
ATT&CK techniques: Data from Cloud Storage (T1530)
Attacker's goals:
Clone existing compute volumes for exfiltration purposes. This action may be a preliminary action before downloading snapshot blocks or creating volumes from the snapshots.
Investigative actions:
Confirm that the identity intended to create the described snapshots. Monitor the source instance for additional suspicious activities. Follow further actions done by the identity.
- Test period:
- N/A (single event)
- Deduplication:
- 1 Day
2 variations:
- EBS snapshots were created from an EC2 instance attached one or more volumes with sensitive data Low (parent: Informational)
- An unusual creation of EBS snapshots from an EC2 instances Low (parent: Informational)