Azure disk snapshot export
A managed-disk snapshot was created, or a download URL was issued for one.
What it detects
A managed-disk snapshot was created, or a download URL was issued for one.
A snapshot is a byte-for-byte copy of a server's disk. Taking one of a production database or a domain controller and then calling beginGetAccess mints a time-limited URL that streams the whole virtual hard drive out over HTTPS — no agent on the machine, no login to it, no file-access telemetry, nothing the workload itself can see. The same trick works by granting another subscription rights to copy it instead, which leaves even less behind.
This is data theft performed entirely in the control plane. Every in-guest control the organisation paid for — EDR, host logging, DLP — is downstream of an attack that never enters the guest.
beginGetAccess is the step that matters most: a snapshot may sit unused, but an access URL exists to be fetched.
MITRE ATT&CK mapping
False positives and triage
Backup tooling and image pipelines snapshot on a schedule, and they will dominate the volume — allowlist those service principals rather than the action, because the action is exactly what an attacker uses. Then read the pair: a snapshot alone is weak evidence, a snapshot followed by beginGetAccess from the same identity is the export. Check whether the caller normally touches this resource group, whether the source disk belongs to a system holding regulated data, and whether the snapshot's target subscription is one the organisation owns — a snapshot shared to an unfamiliar subscription id is the version of this with no innocent explanation. Treat everything on the disk as disclosed from the moment an access URL was issued, including any credentials or key material stored on it.
The rule
Declarative YAML read by the detection engine — data, never executed. Confidence 70%. Source: rules/cloud/azure_disk_snapshot_export.yaml, licensed under the Apache License 2.0.
id: cloud.azure.disk_snapshot_export
version: 1.0.0
status: stable
severity: critical
confidence: 0.7
platforms: [application]
mitre_techniques: [T1578.002, T1537, T1005]
description: |
A managed-disk snapshot was created, or a download URL was issued for one.
A snapshot is a byte-for-byte copy of a server's disk. Taking one of a production
database or a domain controller and then calling `beginGetAccess` mints a
time-limited URL that streams the whole virtual hard drive out over HTTPS — no
agent on the machine, no login to it, no file-access telemetry, nothing the
workload itself can see. The same trick works by granting another subscription
rights to copy it instead, which leaves even less behind.
This is data theft performed entirely in the control plane. Every in-guest
control the organisation paid for — EDR, host logging, DLP — is downstream of an
attack that never enters the guest.
`beginGetAccess` is the step that matters most: a snapshot may sit unused, but an
access URL exists to be fetched.
match:
provider: AzureActivity
event_action_contains_any:
- "Microsoft.Compute/snapshots/write"
- "Microsoft.Compute/snapshots/beginGetAccess/action"
- "Microsoft.Compute/disks/beginGetAccess/action"
correlation_keys: [user_name]
false_positive_guidance: |
Backup tooling and image pipelines snapshot on a schedule, and they will dominate
the volume — allowlist those service principals rather than the action, because
the action is exactly what an attacker uses. Then read the pair: a snapshot alone
is weak evidence, a snapshot followed by `beginGetAccess` from the same identity
is the export. Check whether the caller normally touches this resource group,
whether the source disk belongs to a system holding regulated data, and whether
the snapshot's target subscription is one the organisation owns — a snapshot
shared to an unfamiliar subscription id is the version of this with no innocent
explanation. Treat everything on the disk as disclosed from the moment an access
URL was issued, including any credentials or key material stored on it.
Related detections
Run this rule on your own logs — offline
KIROSEC runs this rule and the rest of the library over Windows, Linux, macOS and cloud audit logs on the analyst's own machine. Every alert links to the events that raised it, and nothing leaves the device.