Skip to content

Commit cc5387d

Browse files
imays11imays11
authored
[New Rule][Deprecation] AWS EC2 Export Task Rules (#5248)
* [New Rule][Deprecation] AWS EC2 Export Tasks Rules **AWS EC2 VM Export Failure** Starting Deprecation process for this rule. I cannot see the value in alerting on a failed VM export attempt. This is rare behavior in general but failed attempts don't warrant an alert especially considering we have no coverage for an actual successful VM Export. This rule has had no alerts in telemetry, I've seen no hits in prod data either. VM exports have a very specific use-case, they can be used to create VM image files that can be downloaded and used to run a VM locally. Successful exports warrant an alert. **AWS EC2 Export Task** This new rule is meant to fill the previously mentioned gap regarding successful VM exports. But also includes other forms of EC2 export tasks. `CreateImageExportTask` `ExportImage` `CreateStoreImageTask` * adding highlighted fields adding highlighted fields * Update rules/integrations/aws/exfiltration_ec2_vm_export_failure.toml * Update rules/integrations/aws/exfiltration_ec2_vm_export_failure.toml
1 parent 5b386e0 commit cc5387d

File tree

2 files changed

+157
-3
lines changed

2 files changed

+157
-3
lines changed

‎rules/integrations/aws/exfiltration_ec2_export_task.toml‎

Lines changed: 154 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,154 @@
1+
[metadata]
2+
creation_date = "2025/10/23"
3+
integration = ["aws"]
4+
maturity = "production"
5+
updated_date = "2025/10/23"
6+
7+
[rule]
8+
author = ["Elastic"]
9+
description = """
10+
Identifies successful export tasks of EC2 instances via the APIs CreateInstanceExportTask, ExportImage, or
11+
CreateStoreImageTask. These exports can be used by administrators for legitimate VM migration or backup workflows
12+
however, an attacker with access to an EC2 instance or AWS credentials can export a VM or its image and then transfer it
13+
off-account for exfiltration of data.
14+
"""
15+
false_positives = [
16+
"""
17+
VM export and EC2 image creation may be done by system administrators, DevOps or migration teams as part of planned
18+
maintenance, disaster-recovery or known backup methods. Verify whether the user identity, user agent, and/or
19+
hostname should be making changes in your environment. Exports from unfamiliar users or hosts should be
20+
investigated. If known behavior is causing false positives, it can be exempted from the rule.
21+
""",
22+
]
23+
from = "now-6m"
24+
index = ["filebeat-*", "logs-aws.cloudtrail-*"]
25+
language = "kuery"
26+
license = "Elastic License v2"
27+
name = "AWS EC2 Export Task"
28+
note = """## Triage and analysis
29+
30+
> **Disclaimer**:
31+
> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.
32+
33+
### Investigating AWS EC2 Export Task
34+
35+
The APIs `CreateInstanceExportTask`, `ExportImage`, and `CreateStoreImageTask` allow the export of a running or stopped EC2 instance (or its AMI/image) to external storage (e.g., S3) or image formats. While often used for migration, cloning or backup, adversaries can leverage these actions to copy full VM state or images out of the environment for exfiltration.
36+
37+
#### Possible investigation steps
38+
39+
**Identify the actor and context**
40+
- Check `aws.cloudtrail.user_identity.arn`, `aws.cloudtrail.user_identity.type`, `aws.cloudtrail.user_identity.access_key_id` to identify who made the call.
41+
- Verify `user_agent.original`, `source.ip` and `@timestamp` to determine whether the action is by known automation, trusted operator, or an unexpected identity or location.
42+
- Confirm `cloud.account.id` and `cloud.region` match the expected account/region for export tasks.
43+
44+
**Examine the specific export/image task details**
45+
- Review `aws.cloudtrail.request_parameters` for details such as the `InstanceId`, `TargetEnvironment`, `S3Bucket`, `S3Key`, `DiskImageFormat`, `ContainerFormat`.
46+
- Check `aws.cloudtrail.response_elements` for the resulting export task ID and status.
47+
- Determine whether the exported instance or image contained sensitive workloads (e.g., production databases, critical systems) via instance tags or asset inventory.
48+
49+
**Pivot to related API calls/events**
50+
- Look for follow-on tasks such as:
51+
- S3 bucket writes or cross-account bucket ACL changes (`PutBucketAcl`/`PutBucketPolicy`) referencing the export S3 bucket or key.
52+
- `CopyImage`, `ModifyImageAttribute`, or `ShareImage` events if the exported image is copied or shared.
53+
- Network or usage anomalies in the region or from the S3 bucket (large downloads from the exported object).
54+
- Check for preceding suspicious actions that could indicate compromise: `AssumeRole`, `CreateAccessKey`, `AttachUserPolicy`, or unusual `Describe*` operations.
55+
56+
**Assess legitimacy and risk**
57+
- Confirm whether this export was authorized (via change ticket or migration workflow) and whether the principal has a documented justification for VM export.
58+
- If unauthorized, assess what was exported, where it is stored, how it may be transferred or used externally, and the data risk exposure.
59+
60+
### False positive analysis
61+
62+
- Legitimate migration or backup workflows may trigger these export/image APIs.
63+
- Development/test environments may export VM images or instances for sandbox cloning.
64+
- Known automation tools may create exports at scheduled times.
65+
66+
### Response and remediation
67+
68+
- Immediately identify and disable or isolate any object/resource created by the export (e.g., the S3 bucket/object, image ID) that is suspected of unauthorized use.
69+
- Revoke the access credentials (`aws.cloudtrail.user_identity.access_key_id`) used if they show unusual activity.
70+
- Rotate keys, enforce MFA, and review IAM permissions for the principal.
71+
- Audit the exported VM/image: review its contents if possible, check whether it has been moved off-account.
72+
- Strengthen monitoring: set alerts for subsequent large data transfers from the S3 export location, cross-account sharing of exported images, or anomalous AMI imports.
73+
- Update policy: restrict who can perform exports, monitor export actions via AWS Config or CloudTrail, tag and track export tasks and their destinations.
74+
"""
75+
references = [
76+
"https://docs.aws.amazon.com/vm-import/latest/userguide/vmexport.html",
77+
"https://docs.aws.amazon.com/vm-import/latest/userguide/vmexport_image.html",
78+
"https://cloud.hacktricks.wiki/en/pentesting-cloud/aws-security/aws-post-exploitation/aws-ec2-ebs-ssm-and-vpc-post-exploitation/aws-ami-store-s3-exfiltration.html,",
79+
]
80+
risk_score = 47
81+
rule_id = "deee5856-25ba-438d-ae53-09d66f41b127"
82+
severity = "medium"
83+
tags = [
84+
"Domain: Cloud",
85+
"Data Source: AWS",
86+
"Data Source: Amazon Web Services",
87+
"Data Source: AWS EC2",
88+
"Use Case: Asset Visibility",
89+
"Tactic: Exfiltration",
90+
"Tactic: Collection",
91+
"Resources: Investigation Guide",
92+
]
93+
timestamp_override = "event.ingested"
94+
type = "query"
95+
96+
query = '''
97+
event.dataset: "aws.cloudtrail" and
98+
event.provider: "ec2.amazonaws.com" and
99+
event.action: ("CreateInstanceExportTask" or "ExportImage" or "CreateStoreImageTask") and
100+
event.outcome: "success"
101+
'''
102+
103+
104+
[[rule.threat]]
105+
framework = "MITRE ATT&CK"
106+
[[rule.threat.technique]]
107+
id = "T1537"
108+
name = "Transfer Data to Cloud Account"
109+
reference = "https://attack.mitre.org/techniques/T1537/"
110+
111+
112+
[rule.threat.tactic]
113+
id = "TA0010"
114+
name = "Exfiltration"
115+
reference = "https://attack.mitre.org/tactics/TA0010/"
116+
[[rule.threat]]
117+
framework = "MITRE ATT&CK"
118+
[[rule.threat.technique]]
119+
id = "T1005"
120+
name = "Data from Local System"
121+
reference = "https://attack.mitre.org/techniques/T1005/"
122+
123+
[[rule.threat.technique]]
124+
id = "T1119"
125+
name = "Automated Collection"
126+
reference = "https://attack.mitre.org/techniques/T1119/"
127+
128+
[[rule.threat.technique]]
129+
id = "T1530"
130+
name = "Data from Cloud Storage"
131+
reference = "https://attack.mitre.org/techniques/T1530/"
132+
133+
134+
[rule.threat.tactic]
135+
id = "TA0009"
136+
name = "Collection"
137+
reference = "https://attack.mitre.org/tactics/TA0009/"
138+
139+
[rule.investigation_fields]
140+
field_names = [
141+
"@timestamp",
142+
"user.name",
143+
"user_agent.original",
144+
"source.ip",
145+
"aws.cloudtrail.user_identity.arn",
146+
"aws.cloudtrail.user_identity.type",
147+
"aws.cloudtrail.user_identity.access_key_id",
148+
"event.action",
149+
"event.outcome",
150+
"cloud.account.id",
151+
"cloud.region",
152+
"aws.cloudtrail.request_parameters",
153+
"aws.cloudtrail.response_elements"
154+
]

‎rules/integrations/aws/exfiltration_ec2_vm_export_failure.toml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
creation_date = "2021/04/22"
33
integration = ["aws"]
44
maturity = "production"
5-
updated_date = "2025/01/15"
5+
updated_date = "2025/10/23"
66

77
[rule]
88
author = ["Elastic", "Austin Songer"]
@@ -22,13 +22,13 @@ index = ["filebeat-*", "logs-aws.cloudtrail-*"]
2222
interval = "10m"
2323
language = "kuery"
2424
license = "Elastic License v2"
25-
name = "AWS EC2 VM Export Failure"
25+
name = "Deprecated - AWS EC2 VM Export Failure"
2626
note = """## Triage and analysis
2727
2828
> **Disclaimer**:
2929
> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.
3030
31-
### Investigating AWS EC2 VM Export Failure
31+
### Investigating Deprecated - AWS EC2 VM Export Failure
3232
3333
AWS EC2 allows users to export virtual machines for backup or migration. However, adversaries might exploit this feature to exfiltrate sensitive data by exporting VMs to unauthorized locations. The detection rule monitors failed export attempts, focusing on specific AWS CloudTrail events, to identify potential exfiltration activities, thereby alerting security teams to investigate further.
3434

0 commit comments

Comments
 (0)