Detect Data Exfiltration via Cross-Account Cloud Snapshot/Image Sharing in Elastic Security

Adversaries with compromised cloud IAM credentials can exfiltrate entire volumes of data without ever moving a byte across a monitored network boundary by abusing native snapshot- and image-sharing primitives to hand a resource directly to an attacker-owned account on the same cloud provider. The canonical pattern (AWS): the operator calls ec2:ModifySnapshotAttribute or ec2:ModifyImageAttribute to add a foreign, attacker-controlled AWS account ID to the resource's launchPermission/createVolumePermission list, then — from that foreign account, using their own credentials — calls ec2:CopySnapshot or ec2:CopyImage to pull the shared EBS snapshot or AMI (and everything on the underlying disk: databases, secrets, source code, customer PII) into infrastructure the victim organization does not control and cannot subpoena. Because the transfer happens entirely inside the cloud provider's control plane and storage backend, it generates no NetFlow, no DNS query, no proxy log, and no EDR process telemetry — the only artifacts are cloud provider management-plane API calls (AWS CloudTrail, and the Azure/GCP equivalents: az snapshot grant-access issuing an cross-tenant SAS, or GCP disk/image IAM bindings adding an external principal). This is distinct from T1567.002 (Exfiltration to Cloud Storage, which moves data via an application-layer upload to a storage bucket/object endpoint) and from T1020 (Automated Exfiltration via a client tool like rclone, already covered elsewhere in this corpus): T1537 specifically covers using the provider's own account-to-account resource-sharing mechanism so the 'transfer' is really a permission grant plus a copy operation the victim's own logging often is never configured to alert on. RDS snapshot sharing (rds:ModifyDBSnapshotAttribute) and S3 cross-account bucket policy/ACL grants follow the identical pattern and are covered as secondary hunting signals below. The technique is a documented step in several cloud-native ransomware and data-theft intrusions (Scattered Spider AWS incidents, multiple Mandiant/Permiso cloud IR cases) precisely because it evades tooling built to watch egress traffic rather than the control plane.