Analytics BIOC
Informational
✕
EC2 instance Amazon machine image was created
Amazon machine image was created from elastic compute cloud instance.
- Module:
- Cortex Cloud
- Licensed by:
- Cloud Runtime Security (CRS)
- Data source:
- AWS Audit Log
ATT&CK tactics: Exfiltration (TA0010)
ATT&CK techniques: Transfer Data to Cloud Account (T1537)
Attacker's goals:
Creating Amazon machine images might be part of elastic compute cloud instance exfiltration chain.
Investigative actions:
Check if {identity_name} to create Amazon machine image. Check if the {cloud_aws_instance_id} instance did not contain any sensitive data.
- Test period:
- N/A (single event)
- Deduplication:
- 1 Day