AWS resource shared externally
An EBS snapshot, AMI, or RDS snapshot had its sharing attribute modified — made public, or shared with another AWS account.
What it detects
An EBS snapshot, AMI, or RDS snapshot had its sharing attribute modified — made public, or shared with another AWS account.
This is exfiltration that never crosses the network perimeter. Rather than downloading a database, an attacker snapshots the volume and grants their own account permission to restore it; the data leaves inside AWS, the transfer looks like ordinary storage administration, and no egress monitoring sees a thing.
MITRE ATT&CK mapping
- T1537Transfer Data to Cloud Account· Exfiltration
False positives and triage
Sharing images and snapshots between an organisation's own accounts is a normal part of multi-account estates and AMI distribution pipelines, so an account list is required to judge this. The signal is a target account outside the organisation, all (public) as the target, sharing performed by an identity that does not normally manage images, or a snapshot created shortly beforehand — check for a CreateSnapshot on the same resource by the same caller.
The rule
Declarative YAML read by the detection engine — data, never executed. Confidence 70%. Source: rules/cloud/aws_resource_shared_externally.yaml, licensed under the Apache License 2.0.
id: cloud.aws.resource_shared_externally
version: 1.0.0
status: stable
severity: high
confidence: 0.7
platforms: [application]
mitre_techniques: [T1537]
description: |
An EBS snapshot, AMI, or RDS snapshot had its sharing attribute modified — made
public, or shared with another AWS account.
This is exfiltration that never crosses the network perimeter. Rather than
downloading a database, an attacker snapshots the volume and grants their own
account permission to restore it; the data leaves inside AWS, the transfer looks
like ordinary storage administration, and no egress monitoring sees a thing.
match:
provider: AWS
event_action_any:
- ModifySnapshotAttribute
- ModifyImageAttribute
- ModifyDBSnapshotAttribute
- ModifyDBClusterSnapshotAttribute
- SharedSnapshotVolumeCreated
correlation_keys: [user_name]
false_positive_guidance: |
Sharing images and snapshots between an organisation's own accounts is a normal
part of multi-account estates and AMI distribution pipelines, so an account list
is required to judge this. The signal is a target account outside the
organisation, `all` (public) as the target, sharing performed by an identity that
does not normally manage images, or a snapshot created shortly beforehand — check
for a `CreateSnapshot` on the same resource by the same caller.
Related detections
Run this rule on your own logs — offline
KIROSEC runs this rule and the rest of the library over Windows, Linux, macOS and cloud audit logs on the analyst's own machine. Every alert links to the events that raised it, and nothing leaves the device.