huntrule

Suspicious AWS Snapshot Backup Exfiltration (via cloudtrail)

This rule detects the modification of an EC2 snapshot's permissions to enable access from another account

SigmamediumCloudv1
sigma
title: Suspicious AWS Snapshot Backup Exfiltration (via cloudtrail)
id: 757b0c8b-bb86-5e57-a04e-56244bdd29fb
status: stable
description: This rule detects the modification of an EC2 snapshot's permissions to enable access from another account
references:
    - https://attack.mitre.org/techniques/T1537/
    - https://www.justice.gov/file/1080281/download
author: Huntrule Team
date: 2026-02-26
tags:
    - attack.exfiltration
    - attack.t1537
logsource:
    product: aws
    service: cloudtrail
detection:
    selection_source:
        eventSource: ec2.amazonaws.com
        eventName: ModifySnapshotAttribute
    condition: selection_source
falsepositives:
    - Unknown
level: medium

Known false positives

  • Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.