Attack in progressA leaked CI key of ‹ci-deploy-bot› is being used to break in: 6 accounts and machines created.Open the case
Snapshot and export exfiltration V-008
Finds snapshots, images and databases made public or shared outside your organization, and unexpected copies or exports.
Checks
| Checks | Needs |
|---|---|
| Catches a snapshot or image sharing setting changed by a non-deployer. | Live events: snapshot, Live events: exposure |
| Catches a snapshot copied, exported or restored by a non-deployer. | Live events: snapshot, Live events: exposure |
| Catches an exposure setting written and then reverted on one resource within 24 hours. | Live events: snapshot, Live events: exposure |
| Catches a database instance changed to publicly accessible. | Live events: snapshot, Live events: exposure |
| Catches a principal creating a key and then using it to copy or export a snapshot. | rds snapshot, rds export task, kms key, Live events: snapshot, Live events: exposure |
| Finds volume snapshots shared publicly or with accounts outside your organization. | ec2 snapshot, ec2 snapshot block public access |
| Finds machine images shared publicly or with accounts outside your organization. | ec2 image |
| Finds database snapshots shared publicly or with accounts outside your organization. | rds snapshot |
| Checks that public sharing of volume snapshots is blocked. | ec2 snapshot block public access, ec2 snapshot |
| Finds databases that are publicly accessible. | rds instance, rds cluster |
Coverage
Could not read anything this run
Run history
No run has recorded this rule yet.
Findings
12 open findings See them grouped
What it fed
No case has used a finding of this rule in the last 30 days.
Techniques
T1530 T1537
How to fix
DescribeSnapshotAttribute / DescribeDBSnapshotAttributes / DescribeExportTasks → remove the out-of-org permission; reversible