{"id":"54b9a76a-3c71-4673-b4b3-2edb4566ea7b","title":"AWS EC2 VM Export Failure","description":"An attempt to export an AWS EC2 instance has been detected. A VM Export might indicate an attempt to extract information from an instance.","author":"Diogo Braz","status":"test","level":"low","date":"2020-04-16","modified":"2022-10-05","tags":["attack.collection","attack.t1005","attack.exfiltration","attack.t1537"],"technique_ids":["T1005","T1537"],"logsource":{"product":"aws","service":"cloudtrail"},"falsepositives":[],"references":["https://docs.aws.amazon.com/vm-import/latest/userguide/vmexport.html#export-instance"],"source_path":"rules/cloud/aws/cloudtrail/aws_ec2_vm_export_failure.yml","source_sha256":"85fb35c3c3e279c3c4a00a0420097d9093cdcb563c4f2bfdfb3f1deedd1377f5","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/cloud/aws/cloudtrail/aws_ec2_vm_export_failure.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: AWS EC2 VM Export Failure\nid: 54b9a76a-3c71-4673-b4b3-2edb4566ea7b\nstatus: test\ndescription: An attempt to export an AWS EC2 instance has been detected. A VM Export might indicate an attempt to extract information from an instance.\nreferences:\n    - https://docs.aws.amazon.com/vm-import/latest/userguide/vmexport.html#export-instance\nauthor: Diogo Braz\ndate: 2020-04-16\nmodified: 2022-10-05\ntags:\n    - attack.collection\n    - attack.t1005\n    - attack.exfiltration\n    - attack.t1537\nlogsource:\n    product: aws\n    service: cloudtrail\ndetection:\n    selection:\n        eventName: 'CreateInstanceExportTask'\n        eventSource: 'ec2.amazonaws.com'\n    filter1:\n        errorMessage|contains: '*'\n    filter2:\n        errorCode|contains: '*'\n    filter3:\n        responseElements|contains: 'Failure'\n    condition: selection and not 1 of filter*\nlevel: low\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1005","id":"T1005","name":"Data from Local System","page":"techniques/enterprise/T1005/"},{"key":"enterprise/T1537","id":"T1537","name":"Transfer Data to Cloud Account","page":"techniques/enterprise/T1537/"}],"data_path":"data/detection-rules/54b9a76a-3c71-4673-b4b3-2edb4566ea7b.json","kind":"sigma"}