AWS Snapshot Backup ExfiltrationJan 10, 2023 · attack.exfiltration attack.t1537 ·
Detects the modification of an EC2 snapshot's permissions to enable access from another account
AWS EC2 VM Export FailureOct 25, 2022 · attack.collection attack.t1005 attack.exfiltration attack.t1537 ·
An attempt to export an AWS EC2 instance has been detected. A VM Export might indicate an attempt to extract information from an instance.
AWS S3 Data Management TamperingOct 9, 2022 · attack.exfiltration attack.t1537 ·
Detects when a user tampers with S3 data management in Amazon Web Services.
Data Exfiltration to Unsanctioned AppsOct 9, 2022 · attack.exfiltration attack.t1537 ·
Detects when a Microsoft Cloud App Security reported when a user or IP address uses an app that is not sanctioned to perform an activity that resembles an attempt to exfiltrate information from your organization.