T1578.001 Create Snapshot — Attack Simulation

Technique description

An adversary may create a snapshot or data backup within a cloud account to evade defenses. A snapshot is a point-in-time copy of an existing cloud compute component such as a virtual machine (VM), virtual hard drive, or volume. An adversary may leverage permissions to create a snapshot in order to bypass restrictions that prevent access to existing compute service infrastructure, unlike in Revert Cloud Instance where an adversary may revert to…

At least one platform-compatible Atomic procedure is documented. Individual review, lab prerequisites, and validation remain required.

Official ATT&CK definition · Detection rules and anomaly models

Documented simulation candidates

• Azure - Create Snapshot from Managed Disk
  iaas:azureautomatedsh

  Procedure 89e69b4b-3458-4ec6-b819-b3008debc1bc; elevation not declared required; cleanup present, not reviewed. Not executed or individually validated.

• AWS - Create Snapshot from EBS Volume
  iaas:awsautomatedsh

  Procedure a3c09662-85bb-4ea8-b15b-6dc8a844e236; elevation not declared required; cleanup present, not reviewed. Not executed or individually validated.

• GCP - Create Snapshot from Persistent Disk
  iaas:gcpautomatedsh

  Procedure e6fbc036-91e7-4ad3-b9cb-f7210f40dd5d; elevation not declared required; cleanup present, not reviewed. Not executed or individually validated.