Title:AWS Snapshot Backup Exfiltration Status:test Description:Detects the modification of an EC2 snapshot's permissions to enable access from another account References: -https://www.justice.gov/file/1080281/download Author: Darin Smith Date: 2021-05-17 modified:2021-08-19 Tags:
-'attack.exfiltration'
-'attack.t1537'
Logsource:
product: aws
service: cloudtrail
Detection: selection_source: eventSource:
'ec2.amazonaws.com' eventName:
'ModifySnapshotAttribute' condition:selection_source Falsepositives:
-Valid change to a snapshot's permissions Level:medium
