Detect Create Snapshot in IBM QRadar
Adversaries may create a snapshot or data backup within a cloud account to evade defenses and gain access to restricted compute infrastructure. A snapshot is a point-in-time copy of a cloud compute component such as a virtual machine (VM), virtual hard drive, or volume. After creating a snapshot, an adversary can create a new cloud instance, mount the snapshot to it, and apply permissive policies (such as firewall rules allowing SSH/RDP) that bypass restrictions enforced on the original resource. This allows access to data and configurations on the original volume without triggering alerts tied to direct access of the live instance. The Pacu AWS exploitation framework includes modules to enumerate and create EBS snapshots and RDS snapshots. Snapshot creation may also precede cross-account sharing, where the adversary modifies snapshot attributes to share it with an attacker-controlled AWS account for offline analysis.
MITRE ATT&CK
- Tactic
- Defense Evasion
- Sub-technique
- T1578.001 Create Snapshot
- Canonical reference
- https://attack.mitre.org/techniques/T1578/001/
QRadar Detection Query
SELECT
DATEFORMAT(devicetime,'yyyy-MM-dd HH:mm:ss') AS EventTime,
username, "Operation" AS CloudOperation,
"ResourceType" AS CloudResource,
"ResourceGroup", "SubscriptionId",
CASE
WHEN "Operation" ILIKE '%delete%' OR "Operation" ILIKE '%destroy%' THEN 90
WHEN "Operation" ILIKE '%snapshot%' AND "ResultType" = 'Success' THEN 70
WHEN "Operation" ILIKE '%create%instance%' THEN 60
ELSE 40
END AS RiskScore,
CASE
WHEN "Operation" ILIKE '%delete%' THEN 'Cloud Resource Deletion'
WHEN "Operation" ILIKE '%snapshot%' THEN 'Snapshot Operation'
WHEN "Operation" ILIKE '%create%' THEN 'Cloud Resource Creation'
ELSE 'Cloud Modification'
END AS AlertType
FROM events
WHERE LOGSOURCETYPENAME(devicetype) ILIKE '%azure%' OR LOGSOURCETYPENAME(devicetype) ILIKE '%cloudtrail%'
AND ("Operation" ILIKE '%compute%' OR "Operation" ILIKE '%instance%' OR "Operation" ILIKE '%snapshot%' OR "Operation" ILIKE '%virtualMachine%')
AND username NOT ILIKE '%azure%automation%'
AND username NOT ILIKE '%backup%service%'
ORDER BY RiskScore DESC
LAST 1 HOURSQRadar AQL detection for Create Snapshot. Detects suspicious cloud snapshot creation and cross-account sharing across Azure (via AzureActivity) and AWS (via AWSCloudTrail). Identifies bulk snapshot creation, off-hours activity, and the high-c
Data Sources
Required Tables
False Positives & Tuning
- Authorized cloud administrators performing snapshot and backup operations
- Automated DR solutions creating scheduled cloud instance snapshots
- DevOps pipelines creating and deleting instances as part of CI/CD
- Authorized infrastructure scaling or migration events
Other platforms for T1578.001
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1AWS EBS Snapshot Creation via CLI
Expected signal: AWS CloudTrail: EventName=CreateSnapshot, EventSource=ec2.amazonaws.com, RequestParameters.volumeId=vol-0123456789abcdef0, ResponseElements.snapshotId=snap-<generated>. UserIdentityArn will reflect the IAM principal used. SourceIPAddress will show the originating IP of the CLI call. RecipientAccountId will show the AWS account number.
- Test 2AWS Snapshot Cross-Account Share (External Exfiltration Simulation)
Expected signal: AWS CloudTrail: EventName=ModifySnapshotAttribute, EventSource=ec2.amazonaws.com, RequestParameters.attributeType=createVolumePermission, RequestParameters.operationType=add, RequestParameters.createVolumePermission.add.items[0].userId=123456789012. The event is logged even if the call returns an error response.
- Test 3Azure Disk Snapshot Creation via CLI
Expected signal: Azure Activity Log: OperationNameValue=MICROSOFT.COMPUTE/SNAPSHOTS/WRITE, ActivityStatusValue=Succeeded, ResourceId contains /snapshots/df00tech-atomictest-T1578001. Caller will reflect the authenticated Azure principal (user UPN or service principal object ID). CallerIpAddress will show the source IP of the az CLI call.
- Test 4Pacu AWS Exploitation Framework Snapshot Enumeration and Creation
Expected signal: AWS CloudTrail: Multiple DescribeSnapshots API calls from the Pacu session, EventSource=ec2.amazonaws.com. UserAgent field will contain 'python-requests' or 'Boto3' and may contain 'Pacu'. If the session escalates to creation, CreateSnapshot events will appear. Source IP will match the host running Pacu.
References (12)
- https://attack.mitre.org/techniques/T1578/001/
- https://www.mandiant.com/sites/default/files/2021-09/mtrends-2020.pdf
- https://github.com/RhinoSecurityLabs/pacu
- https://docs.aws.amazon.com/aws-backup/latest/devguide/logging-using-cloudtrail.html
- https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CreateSnapshot.html
- https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ModifySnapshotAttribute.html
- https://docs.microsoft.com/en-us/azure/backup/backup-azure-monitoring-use-azuremonitor
- https://cloud.google.com/compute/docs/instances/create-start-instance
- https://cloud.google.com/logging/docs/audit#admin-activity
- https://docs.microsoft.com/en-us/azure/azure-monitor/essentials/activity-log
- https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-event-reference-user-identity.html
- https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation/
Unlock Pro Content
Get the full detection package for T1578.001 including response playbook, investigation guide, and atomic red team tests.