{"id":"abae8fec-57bd-4f87-aff6-6e3db989843d","title":"AWS Snapshot Backup Exfiltration","description":"Detects the modification of an EC2 snapshot's permissions to enable access from another account","author":"Darin Smith","status":"test","level":"medium","date":"2021-05-17","modified":"2021-08-19","tags":["attack.exfiltration","attack.t1537"],"technique_ids":["T1537"],"logsource":{"product":"aws","service":"cloudtrail"},"falsepositives":["Valid change to a snapshot's permissions"],"references":["https://www.justice.gov/file/1080281/download"],"source_path":"rules/cloud/aws/cloudtrail/aws_snapshot_backup_exfiltration.yml","source_sha256":"f51c4544237d7eba85fc71f3e3bfbda7683331852c83ec502e14a180da563d96","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/cloud/aws/cloudtrail/aws_snapshot_backup_exfiltration.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: AWS Snapshot Backup Exfiltration\nid: abae8fec-57bd-4f87-aff6-6e3db989843d\nstatus: test\ndescription: Detects the modification of an EC2 snapshot's permissions to enable access from another account\nreferences:\n    - https://www.justice.gov/file/1080281/download\nauthor: Darin Smith\ndate: 2021-05-17\nmodified: 2021-08-19\ntags:\n    - attack.exfiltration\n    - attack.t1537\nlogsource:\n    product: aws\n    service: cloudtrail\ndetection:\n    selection_source:\n        eventSource: ec2.amazonaws.com\n        eventName: ModifySnapshotAttribute\n    condition: selection_source\nfalsepositives:\n    - Valid change to a snapshot's permissions\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1537","id":"T1537","name":"Transfer Data to Cloud Account","page":"techniques/enterprise/T1537/"}],"data_path":"data/detection-rules/abae8fec-57bd-4f87-aff6-6e3db989843d.json","kind":"sigma"}