AWS CloudTrail: EC2 Snapshot Attribute Permission Modified for Cross-Account Access

Alerts on CloudTrail ModifySnapshotAttribute events indicating EC2 snapshot permissions were changed for other-account access.

FreeReviewedSigma · Medium · v5

Product: aws
Service: cloudtrail
Author: Darin Smith (SigmaHQ), DRL 1.1
Published: 2021-05-17
Updated: 2026-07-31

Analysis Detection

ATT&CK techniques

Exfiltration

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
- T1537Transfer Data to Cloud Account
Impact

What it detects

This rule flags CloudTrail events where an EC2 snapshot’s attributes are modified, specifically when snapshot permissions are changed via ModifySnapshotAttribute. Attackers can use this to grant access from another AWS account, enabling data exfiltration or unauthorized sharing of snapshot contents. Detection relies on CloudTrail telemetry capturing the EC2 API call and its source event fields.

Reporting behind it

Related detections9 linkedT1537 — drag to rearrange

Suspicious S3 Bucket Replication Configured via Scattered Spider Exfiltration Technique

Suspicious AWS Instance Access or Export via SSH Key or Export Task

Suspicious Container Image Export via ctr in Cloud Model Exfiltration

Suspicious AWS Transfer Family Server Creation for Data Exfiltration (via cloudtrail)

Suspicious EC2 Snapshot Attribute Modification for External Sharing via CloudTrail

Suspicious Cross-Project Compute Snapshot Creation via GCP Audit

Suspicious Compute Disk IAM Policy Modification Granting Owner Role via GCP Audit

Suspicious EBS Snapshot Shared With External Account via CloudTrail

Suspicious GCP Bucket Deletion for Namespace Hijacking (via gcp)

AWS CloudTrail: EC2 Snapshot Attribute Permission Modified for Cross-Account Access

Pivot detection · T1537 · 9 related

Changelog

v5
Candidate ingested via manual entry.2026-07-31
v4
Candidate ingested via manual entry.2026-07-31
v3
Candidate ingested via manual entry.2026-07-31
v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

aws-cloudtrail-modify-ec2-snapshot-permissions-for-cross-account-access-abae8fec

title: "AWS CloudTrail: EC2 Snapshot Attribute Permission Modified for Cross-Account Access"
id: 14e5dce0-44d7-4c91-b6c4-20c40ecb78e1
status: test
description: This rule flags CloudTrail events where an EC2 snapshot’s attributes are modified, specifically when snapshot permissions are changed via ModifySnapshotAttribute. Attackers can use this to grant access from another AWS account, enabling data exfiltration or unauthorized sharing of snapshot contents. Detection relies on CloudTrail telemetry capturing the EC2 API call and its source event fields.
references:
  - https://www.justice.gov/file/1080281/download
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/aws/cloudtrail/aws_snapshot_backup_exfiltration.yml
author: Darin Smith, Huntrule Team
date: 2021-05-17
modified: 2021-08-19
tags:
  - attack.exfiltration
  - attack.t1537
logsource:
  product: aws
  service: cloudtrail
detection:
  selection_source:
    eventSource: ec2.amazonaws.com
    eventName: ModifySnapshotAttribute
  condition: selection_source
falsepositives:
  - Valid change to a snapshot's permissions
level: medium
license: DRL-1.1
related:
  - id: abae8fec-57bd-4f87-aff6-6e3db989843d
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL