Detect Create Snapshot in Google Chronicle
Adversaries may create a snapshot or data backup within a cloud account to evade defenses and gain access to restricted compute infrastructure. A snapshot is a point-in-time copy of a cloud compute component such as a virtual machine (VM), virtual hard drive, or volume. After creating a snapshot, an adversary can create a new cloud instance, mount the snapshot to it, and apply permissive policies (such as firewall rules allowing SSH/RDP) that bypass restrictions enforced on the original resource. This allows access to data and configurations on the original volume without triggering alerts tied to direct access of the live instance. The Pacu AWS exploitation framework includes modules to enumerate and create EBS snapshots and RDS snapshots. Snapshot creation may also precede cross-account sharing, where the adversary modifies snapshot attributes to share it with an attacker-controlled AWS account for offline analysis.
MITRE ATT&CK
- Tactic
- Defense Evasion
- Sub-technique
- T1578.001 Create Snapshot
- Canonical reference
- https://attack.mitre.org/techniques/T1578/001/
YARA-L Detection Query
rule T1578_001_cloud_infra_modification {
meta:
author = "Detection Engineering"
description = "Detects suspicious cloud infrastructure modifications"
severity = "high"
confidence = "medium"
mitre_attack = "T1578.001"
reference = "https://attack.mitre.org/techniques/T1578/001/"
events:
$e.metadata.event_type = "USER_RESOURCE_ACCESS"
re.regex($e.metadata.product_event_type, `(?i)(snapshot|virtualMachine|instance|compute|create|delete|modify)`)
not re.regex($e.principal.user.email_addresses, `(?i)(backup|automation|serviceaccount)`)
condition:
$e
}Google Chronicle YARA-L 2.0 detection for Create Snapshot. Detects suspicious cloud snapshot creation and cross-account sharing across Azure (via AzureActivity) and AWS (via AWSCloudTrail). Identifies bulk snapshot creation, off-hours activity, and the high-c
Data Sources
Required Tables
False Positives & Tuning
- Authorized cloud administrators performing scheduled backup snapshot creation
- Automated disaster recovery solutions creating routine cloud instance snapshots
- DevOps CI/CD pipelines creating and deleting compute instances during deployments
- Authorized cloud migration projects moving instances between regions
Other platforms for T1578.001
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1AWS EBS Snapshot Creation via CLI
Expected signal: AWS CloudTrail: EventName=CreateSnapshot, EventSource=ec2.amazonaws.com, RequestParameters.volumeId=vol-0123456789abcdef0, ResponseElements.snapshotId=snap-<generated>. UserIdentityArn will reflect the IAM principal used. SourceIPAddress will show the originating IP of the CLI call. RecipientAccountId will show the AWS account number.
- Test 2AWS Snapshot Cross-Account Share (External Exfiltration Simulation)
Expected signal: AWS CloudTrail: EventName=ModifySnapshotAttribute, EventSource=ec2.amazonaws.com, RequestParameters.attributeType=createVolumePermission, RequestParameters.operationType=add, RequestParameters.createVolumePermission.add.items[0].userId=123456789012. The event is logged even if the call returns an error response.
- Test 3Azure Disk Snapshot Creation via CLI
Expected signal: Azure Activity Log: OperationNameValue=MICROSOFT.COMPUTE/SNAPSHOTS/WRITE, ActivityStatusValue=Succeeded, ResourceId contains /snapshots/df00tech-atomictest-T1578001. Caller will reflect the authenticated Azure principal (user UPN or service principal object ID). CallerIpAddress will show the source IP of the az CLI call.
- Test 4Pacu AWS Exploitation Framework Snapshot Enumeration and Creation
Expected signal: AWS CloudTrail: Multiple DescribeSnapshots API calls from the Pacu session, EventSource=ec2.amazonaws.com. UserAgent field will contain 'python-requests' or 'Boto3' and may contain 'Pacu'. If the session escalates to creation, CreateSnapshot events will appear. Source IP will match the host running Pacu.
References (12)
- https://attack.mitre.org/techniques/T1578/001/
- https://www.mandiant.com/sites/default/files/2021-09/mtrends-2020.pdf
- https://github.com/RhinoSecurityLabs/pacu
- https://docs.aws.amazon.com/aws-backup/latest/devguide/logging-using-cloudtrail.html
- https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CreateSnapshot.html
- https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ModifySnapshotAttribute.html
- https://docs.microsoft.com/en-us/azure/backup/backup-azure-monitoring-use-azuremonitor
- https://cloud.google.com/compute/docs/instances/create-start-instance
- https://cloud.google.com/logging/docs/audit#admin-activity
- https://docs.microsoft.com/en-us/azure/azure-monitor/essentials/activity-log
- https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-event-reference-user-identity.html
- https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation/
Unlock Pro Content
Get the full detection package for T1578.001 including response playbook, investigation guide, and atomic red team tests.