AWS CloudTrail EC2 CreateInstanceExportTask Failure

Flags failed EC2 VM export task creation events in AWS CloudTrail to surface potential instance data extraction attempts.

FreeReviewedSigma · Low · v5

Product: aws
Service: cloudtrail
Author: Diogo Braz (SigmaHQ), DRL 1.1
Published: 2020-04-16
Updated: 2026-07-31

Analysis Detection

ATT&CK techniques

Collection → Exfiltration

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
- T1005Data from Local System
C2
Exfiltration
- T1537Transfer Data to Cloud Account
Impact

What it detects

This rule identifies CloudTrail events where an EC2 VM export task is created (CreateInstanceExportTask) and the event indicates a failure. Attackers may attempt VM export to collect or exfiltrate information from an EC2 instance, and repeated or failed export attempts can still signal reconnaissance or data collection activity. The detection relies on CloudTrail telemetry fields for event name, event source, and response content indicating failure.

Reporting behind it

Related detections9 linkedT1005 — drag to rearrange

Malicious Velvet Ant Linux Backdoor and Credential Harvesting Artifacts (via file_event)

Malicious Browser Credential Dump File Drop by Phantom Stealer via file_event

Suspicious S3 Bucket Replication Configured via Scattered Spider Exfiltration Technique

Suspicious AWS Instance Access or Export via SSH Key or Export Task

Suspicious Cryptocurrency Wallet File Access by Stealer (via process_creation)

Suspicious Container Image Export via ctr in Cloud Model Exfiltration

Suspicious PAN-OS Running Config Staged as Web Content via CVE-2024-3400

Suspicious Infostealer Log Artifacts Written to Disk (via file_event)

Suspicious AWS Transfer Family Server Creation for Data Exfiltration (via cloudtrail)

AWS CloudTrail EC2 CreateInstanceExportTask Failure

Pivot detection · T1005 · 9 related

Changelog

v5
Candidate ingested via manual entry.2026-07-31
v4
Candidate ingested via manual entry.2026-07-31
v3
Candidate ingested via manual entry.2026-07-31
v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

aws-cloudtrail-detects-ec2-createinstanceexporttask-failure-54b9a76a

title: AWS CloudTrail EC2 CreateInstanceExportTask Failure
id: e33f577f-5f28-472e-a870-6c6e29785d6d
status: test
description: This rule identifies CloudTrail events where an EC2 VM export task is created (CreateInstanceExportTask) and the event indicates a failure. Attackers may attempt VM export to collect or exfiltrate information from an EC2 instance, and repeated or failed export attempts can still signal reconnaissance or data collection activity. The detection relies on CloudTrail telemetry fields for event name, event source, and response content indicating failure.
references:
  - https://docs.aws.amazon.com/vm-import/latest/userguide/vmexport.html#export-instance
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/aws/cloudtrail/aws_ec2_vm_export_failure.yml
author: Diogo Braz, Huntrule Team
date: 2020-04-16
modified: 2022-10-05
tags:
  - attack.collection
  - attack.t1005
  - attack.exfiltration
  - attack.t1537
logsource:
  product: aws
  service: cloudtrail
detection:
  selection:
    eventName: CreateInstanceExportTask
    eventSource: ec2.amazonaws.com
  filter1:
    errorMessage|contains: "*"
  filter2:
    errorCode|contains: "*"
  filter3:
    responseElements|contains: Failure
  condition: selection and not 1 of filter*
level: low
license: DRL-1.1
related:
  - id: 54b9a76a-3c71-4673-b4b3-2edb4566ea7b
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL