AWS EC2 VM Export Failure

Status: test
Severity: low
Log source: product aws, service cloudtrail
Author: Diogo Braz
Source: github.com/SigmaHQ/sigma

An attempt to export an AWS EC2 instance has been detected. A VM Export might indicate an attempt to extract information from an instance.

MITRE ATT&CK coverage

Tactic	Techniques
Collection	`T1005` Data from Local System
Exfiltration	`T1537` Transfer Data to Cloud Account

Telemetry coverage

Platform	Record / event type
AWS	CloudTrail event `CreateInstanceExportTask`: Exports a running or stopped EC2 instance to an Amazon S3 bucket in OVA, VHD, or VMDK format.

Rules detecting the same action

These rules filter on the same operation.

AWS EC2 Export Task (Elastic)
AWS Modify Cloud Compute Infrastructure (Panther)

Rule body

title: AWS EC2 VM Export Failure
id: 54b9a76a-3c71-4673-b4b3-2edb4566ea7b
status: test
description: An attempt to export an AWS EC2 instance has been detected. A VM Export might indicate an attempt to extract information from an instance.
references:
    - https://docs.aws.amazon.com/vm-import/latest/userguide/vmexport.html#export-instance
author: Diogo Braz
date: 2020-04-16
modified: 2022-10-05
tags:
    - attack.collection
    - attack.t1005
    - attack.exfiltration
    - attack.t1537
logsource:
    product: aws
    service: cloudtrail
detection:
    selection:
        eventName: 'CreateInstanceExportTask'
        eventSource: 'ec2.amazonaws.com'
    filter1:
        errorMessage|contains: '*'
    filter2:
        errorCode|contains: '*'
    filter3:
        responseElements|contains: 'Failure'
    condition: selection and not 1 of filter*
level: low

Stages and Predicates

Stage 0: `condition`

selection and not 1 of filter*

Stage 1: `selection`

selection:
    eventName: 'CreateInstanceExportTask'
    eventSource: 'ec2.amazonaws.com'

Stage 2: `not filter*`

filter1:
    errorMessage|contains: '*'
filter2:
    errorCode|contains: '*'
filter3:
    responseElements|contains: 'Failure'

Exclusions

The rule actively suppresses these predicates.

Field	Kind	Excluded values	Search
`errorCode`	match	`*`	`excludes:errorCode` `field:"errorCode" value:"*"`
`errorMessage`	match	`*`	`excludes:errorMessage` `field:"errorMessage" value:"*"`
`responseElements`	match	`Failure`	`excludes:responseElements` `field:"responseElements" value:"Failure"`

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`eventName`	eq	`CreateInstanceExportTask`	`field:"aws::eventName" kind:eq value:"CreateInstanceExportTask"`
`eventSource`	eq	`ec2.amazonaws.com`	`field:"aws::eventSource" kind:eq value:"ec2.amazonaws.com"`