Cloud Instance Reverted to Snapshot for Cleanup
This rule detects HTTP traffic indicating an Amazon EC2 instance is being reverted to a snapshot. Specifically, it looks for HTTP requests to 'ec2.amazonaws.com' with the URI containing 'RestoreSnapshotTier'. This activity could be part of a cleanup process or an attempt to restore a compromised instance to a known good state, but could also be used by an attacker for defense evasion by reverting changes.
Suricata
