AWS EC2 Snapshot Permission Modification for Exfiltration

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•39

This rule detects when an AWS EC2 snapshot's permissions are modified to allow access from another AWS account. This activity can indicate an attempt to exfiltrate data stored in the snapshot by sharing it with an adversary-controlled account.