SigmaHQ/rules/cloud/aws_ec2_vm_export_failure.yml
2020-10-15 23:31:55 -03:00

30 lines
841 B
YAML

title: AWS EC2 VM Export Failure
id: 54b9a76a-3c71-4673-b4b3-2edb4566ea7b
status: experimental
description: An attempt to export an AWS EC2 instance has been detected. A VM Export might indicate an attempt to extract information from an instance.
author: Diogo Braz
date: 2020/04/16
references:
- https://docs.aws.amazon.com/vm-import/latest/userguide/vmexport.html#export-instance
logsource:
service: cloudtrail
detection:
selection:
eventName: 'CreateInstanceExportTask'
eventSource: 'ec2.amazonaws.com'
filter1:
errorMessage: '*'
filter2:
errorCode: '*'
filter3:
eventName: 'ConsoleLogin'
responseElements|contains: 'Failure'
condition: selection and (filter1 or filter2 or filter3)
level: low
tags:
- attack.collection
- attack.t1005
- attack.exfiltration
- attack.t1537