AWS CloudTrail Detects EC2 CreateInstanceExportTask Failure

Flags failed EC2 VM export task creation events in AWS CloudTrail to surface potential instance data extraction attempts.

FreeUnreviewedSigmalowv1

aws-cloudtrail-detects-ec2-createinstanceexporttask-failure-54b9a76a

title: AWS CloudTrail Detects EC2 CreateInstanceExportTask Failure
id: e33f577f-5f28-472e-a870-6c6e29785d6d
status: test
description: This rule identifies CloudTrail events where an EC2 VM export task is created via CreateInstanceExportTask and the outcome is marked as Failure. VM export attempts can be used to extract data from an instance, and failures still indicate suspicious activity that may precede successful export. The detection relies on CloudTrail fields for eventName, eventSource, responseElements containing Failure, and exclusion of certain errorMessage and errorCode patterns.
references:
  - https://docs.aws.amazon.com/vm-import/latest/userguide/vmexport.html#export-instance
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/aws/cloudtrail/aws_ec2_vm_export_failure.yml
author: Diogo Braz, Huntrule Team
date: 2020-04-16
modified: 2022-10-05
tags:
  - attack.collection
  - attack.t1005
  - attack.exfiltration
  - attack.t1537
logsource:
  product: aws
  service: cloudtrail
detection:
  selection:
    eventName: CreateInstanceExportTask
    eventSource: ec2.amazonaws.com
  filter1:
    errorMessage|contains: "*"
  filter2:
    errorCode|contains: "*"
  filter3:
    responseElements|contains: Failure
  condition: selection and not 1 of filter*
level: low
license: DRL-1.1
related:
  - id: 54b9a76a-3c71-4673-b4b3-2edb4566ea7b
    type: derived

What it detects

This rule identifies CloudTrail events where an EC2 VM export task is created via CreateInstanceExportTask and the outcome is marked as Failure. VM export attempts can be used to extract data from an instance, and failures still indicate suspicious activity that may precede successful export. The detection relies on CloudTrail fields for eventName, eventSource, responseElements containing Failure, and exclusion of certain errorMessage and errorCode patterns.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.