AWS CloudTrail EC2 CreateInstanceExportTask Failure

Flags failed EC2 VM export task creation events in AWS CloudTrail to surface potential instance data extraction attempts.

FreeReviewedSigma · Low · v5

Product: aws
Service: cloudtrail
Author: Diogo Braz (SigmaHQ), DRL 1.1
Published: 2020-04-16
Updated: 2026-07-31

Analysis Detection

ATT&CK techniques

Collection → Exfiltration

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
- T1005Data from Local System
C2
Exfiltration
- T1537Transfer Data to Cloud Account
Impact

What it detects

This rule identifies CloudTrail events where an EC2 VM export task is created (CreateInstanceExportTask) and the event indicates a failure. Attackers may attempt VM export to collect or exfiltrate information from an EC2 instance, and repeated or failed export attempts can still signal reconnaissance or data collection activity. The detection relies on CloudTrail telemetry fields for event name, event source, and response content indicating failure.

Reporting behind it

Related detections9 linkedT1005 — drag to rearrange

Suspicious BoryptGrab Infostealer Staging Directory (via file_event)

Suspicious Compute Disk IAM Policy Modification Granting Owner Role via GCP Audit

Suspicious Astaroth Spambot Browser Profile Staging Directory (via file_event)

Suspicious EBS Snapshot Shared With External Account via CloudTrail

Suspicious Browser and Wallet Credential Theft via JavaScript Stealer

Suspicious WhatsAppBackup Data Staging Archive Creation

Suspicious Environment File Credential Search via findstr (via process_creation)

Suspicious RDP Bitmap Cache Temp Files Written by mstsc in Rogue RDP Campaign (via file_event)

Suspicious GCP Bucket Deletion for Namespace Hijacking (via gcp)

AWS CloudTrail EC2 CreateInstanceExportTask Failure

Pivot detection · T1005 · 9 related

Changelog

v5
Candidate ingested via manual entry.2026-07-31
v4
Candidate ingested via manual entry.2026-07-31
v3
Candidate ingested via manual entry.2026-07-31
v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

aws-cloudtrail-detects-ec2-createinstanceexporttask-failure-54b9a76a

title: AWS CloudTrail EC2 CreateInstanceExportTask Failure
id: e33f577f-5f28-472e-a870-6c6e29785d6d
status: test
description: This rule identifies CloudTrail events where an EC2 VM export task is created (CreateInstanceExportTask) and the event indicates a failure. Attackers may attempt VM export to collect or exfiltrate information from an EC2 instance, and repeated or failed export attempts can still signal reconnaissance or data collection activity. The detection relies on CloudTrail telemetry fields for event name, event source, and response content indicating failure.
references:
  - https://docs.aws.amazon.com/vm-import/latest/userguide/vmexport.html#export-instance
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/aws/cloudtrail/aws_ec2_vm_export_failure.yml
author: Diogo Braz, Huntrule Team
date: 2020-04-16
modified: 2022-10-05
tags:
  - attack.collection
  - attack.t1005
  - attack.exfiltration
  - attack.t1537
logsource:
  product: aws
  service: cloudtrail
detection:
  selection:
    eventName: CreateInstanceExportTask
    eventSource: ec2.amazonaws.com
  filter1:
    errorMessage|contains: "*"
  filter2:
    errorCode|contains: "*"
  filter3:
    responseElements|contains: Failure
  condition: selection and not 1 of filter*
level: low
license: DRL-1.1
related:
  - id: 54b9a76a-3c71-4673-b4b3-2edb4566ea7b
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL