AWS CloudTrail: Modify EC2 Snapshot Permissions for Cross-Account Access

Alerts on CloudTrail ModifySnapshotAttribute events indicating EC2 snapshot permissions were changed for other-account access.

FreeUnreviewedSigmamediumv1

aws-cloudtrail-modify-ec2-snapshot-permissions-for-cross-account-access-abae8fec

title: "AWS CloudTrail: Modify EC2 Snapshot Permissions for Cross-Account Access"
id: 14e5dce0-44d7-4c91-b6c4-20c40ecb78e1
status: test
description: This rule flags CloudTrail events where an EC2 snapshot attribute is modified, specifically the snapshot permission changes that can grant access to another AWS account. Such changes can enable data exfiltration by making snapshot contents available outside the original account boundary. It relies on CloudTrail records with eventSource ec2.amazonaws.com and eventName ModifySnapshotAttribute.
references:
  - https://www.justice.gov/file/1080281/download
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/aws/cloudtrail/aws_snapshot_backup_exfiltration.yml
author: Darin Smith, Huntrule Team
date: 2021-05-17
modified: 2021-08-19
tags:
  - attack.exfiltration
  - attack.t1537
logsource:
  product: aws
  service: cloudtrail
detection:
  selection_source:
    eventSource: ec2.amazonaws.com
    eventName: ModifySnapshotAttribute
  condition: selection_source
falsepositives:
  - Valid change to a snapshot's permissions
level: medium
license: DRL-1.1
related:
  - id: abae8fec-57bd-4f87-aff6-6e3db989843d
    type: derived

What it detects

This rule flags CloudTrail events where an EC2 snapshot attribute is modified, specifically the snapshot permission changes that can grant access to another AWS account. Such changes can enable data exfiltration by making snapshot contents available outside the original account boundary. It relies on CloudTrail records with eventSource ec2.amazonaws.com and eventName ModifySnapshotAttribute.

Known false positives

Valid change to a snapshot's permissions

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.