Analytics Informational
✕

Multiple cloud snapshots export

A cloud identity has downloaded multiple virtual machines or DB snapshots locally.

Module:
Cortex Cloud
Licensed by:
Cloud Runtime Security (CRS)
Data source:
AWS Audit Log, Azure Audit Log, Gcp Audit Log
ATT&CK tactics: Exfiltration (TA0010)
ATT&CK techniques: Transfer Data to Cloud Account (T1537)
Detector tags: Cloud Data Asset Exfiltration Data Detection & Response
Attacker's goals:

Exfiltrate sensitive data that resides on the disk.

Investigative actions:

Check if the identity intended to export the virtual machines or DB snapshots. Check if the identity performed additional operations in the cloud environment that might be malicious.

Test period:
2 Hours
Deduplication:
5 Days
4 variations:
  • Multiple cloud snapshots export High (parent: Informational)
  • Multiple cloud snapshots export Medium (parent: Informational)
  • Multiple cloud snapshots export Low (parent: Informational)
  • Multiple cloud snapshots export Low (parent: Informational)