Detect Create Snapshot in Sumo Logic CSE
Adversaries may create a snapshot or data backup within a cloud account to evade defenses and gain access to restricted compute infrastructure. A snapshot is a point-in-time copy of a cloud compute component such as a virtual machine (VM), virtual hard drive, or volume. After creating a snapshot, an adversary can create a new cloud instance, mount the snapshot to it, and apply permissive policies (such as firewall rules allowing SSH/RDP) that bypass restrictions enforced on the original resource. This allows access to data and configurations on the original volume without triggering alerts tied to direct access of the live instance. The Pacu AWS exploitation framework includes modules to enumerate and create EBS snapshots and RDS snapshots. Snapshot creation may also precede cross-account sharing, where the adversary modifies snapshot attributes to share it with an attacker-controlled AWS account for offline analysis.
MITRE ATT&CK
- Tactic
- Defense Evasion
- Sub-technique
- T1578.001 Create Snapshot
- Canonical reference
- https://attack.mitre.org/techniques/T1578/001/
Sumo Detection Query
_sourceCategory=*azure*activitylog* OR _sourceCategory=*aws*cloudtrail*
| json auto
| where matches(operationName, "(?i)(snapshot|virtualMachine|instance|compute|create|delete|modify)")
| eval RiskLevel = if(matches(operationName, "(?i)(delete|destroy|terminate)"), "High",
if(matches(operationName, "(?i)(snapshot|create)"), "Medium", "Low"))
| where RiskLevel in ("High","Medium")
| eval AlertType = if(matches(operationName, "(?i)delete"), "Cloud Resource Deletion",
if(matches(operationName, "(?i)snapshot"), "Snapshot Operation",
if(matches(operationName, "(?i)create"), "Resource Creation", "Cloud Modification")))
| where caller != "azure-backup" and !matches(caller, "(?i)automation")
| stats count AS OpCount, values(operationName) AS Operations, values(RiskLevel) AS RiskLevels by _sourceHost, caller, resourceGroup
| sort by OpCount descSumo Logic detection for Create Snapshot. Detects suspicious cloud snapshot creation and cross-account sharing across Azure (via AzureActivity) and AWS (via AWSCloudTrail). Identifies bulk snapshot creation, off-hours activity, and the high-c
Data Sources
Required Tables
False Positives & Tuning
- Cloud administrators creating authorized snapshots for backup or migration
- Automated disaster recovery systems creating scheduled cloud snapshots
- DevOps pipelines creating and deleting compute instances as part of CI/CD
- Authorized cloud infrastructure migrations between regions or accounts
Other platforms for T1578.001
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1AWS EBS Snapshot Creation via CLI
Expected signal: AWS CloudTrail: EventName=CreateSnapshot, EventSource=ec2.amazonaws.com, RequestParameters.volumeId=vol-0123456789abcdef0, ResponseElements.snapshotId=snap-<generated>. UserIdentityArn will reflect the IAM principal used. SourceIPAddress will show the originating IP of the CLI call. RecipientAccountId will show the AWS account number.
- Test 2AWS Snapshot Cross-Account Share (External Exfiltration Simulation)
Expected signal: AWS CloudTrail: EventName=ModifySnapshotAttribute, EventSource=ec2.amazonaws.com, RequestParameters.attributeType=createVolumePermission, RequestParameters.operationType=add, RequestParameters.createVolumePermission.add.items[0].userId=123456789012. The event is logged even if the call returns an error response.
- Test 3Azure Disk Snapshot Creation via CLI
Expected signal: Azure Activity Log: OperationNameValue=MICROSOFT.COMPUTE/SNAPSHOTS/WRITE, ActivityStatusValue=Succeeded, ResourceId contains /snapshots/df00tech-atomictest-T1578001. Caller will reflect the authenticated Azure principal (user UPN or service principal object ID). CallerIpAddress will show the source IP of the az CLI call.
- Test 4Pacu AWS Exploitation Framework Snapshot Enumeration and Creation
Expected signal: AWS CloudTrail: Multiple DescribeSnapshots API calls from the Pacu session, EventSource=ec2.amazonaws.com. UserAgent field will contain 'python-requests' or 'Boto3' and may contain 'Pacu'. If the session escalates to creation, CreateSnapshot events will appear. Source IP will match the host running Pacu.
References (12)
- https://attack.mitre.org/techniques/T1578/001/
- https://www.mandiant.com/sites/default/files/2021-09/mtrends-2020.pdf
- https://github.com/RhinoSecurityLabs/pacu
- https://docs.aws.amazon.com/aws-backup/latest/devguide/logging-using-cloudtrail.html
- https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CreateSnapshot.html
- https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ModifySnapshotAttribute.html
- https://docs.microsoft.com/en-us/azure/backup/backup-azure-monitoring-use-azuremonitor
- https://cloud.google.com/compute/docs/instances/create-start-instance
- https://cloud.google.com/logging/docs/audit#admin-activity
- https://docs.microsoft.com/en-us/azure/azure-monitor/essentials/activity-log
- https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-event-reference-user-identity.html
- https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation/
Unlock Pro Content
Get the full detection package for T1578.001 including response playbook, investigation guide, and atomic red team tests.