Title:AWS EC2 VM Export Failure Status:test Description:An attempt to export an AWS EC2 instance has been detected. A VM Export might indicate an attempt to extract information from an instance. References: -https://docs.aws.amazon.com/vm-import/latest/userguide/vmexport.html#export-instance Author: Diogo Braz Date: 2020-04-16 modified:2022-10-05 Tags:
-'attack.collection'
-'attack.t1005'
-'attack.exfiltration'
-'attack.t1537'
Logsource:
product: aws
service: cloudtrail
Detection: selection: eventName:
'CreateInstanceExportTask' eventSource:
'ec2.amazonaws.com' filter1: errorMessage|contains:
'*' filter2: errorCode|contains:
'*' filter3: responseElements|contains:
'Failure' condition:selection and not 1 of filter* Falsepositives: Level:low
