Skip to content

Hide Navigation Hide TOC

Snapshot Modification (f1eb6ea9-f3ab-414f-af35-2d5427199984)

Changes made to a cloud snapshot's metadata, attributes, or control settings. These modifications may involve adjusting access permissions, changing retention policies, or altering encryption settings.

Data Collection Measures:

  • AWS CloudTrail
    • Tracks API calls such as ModifySnapshotAttribute, ResetSnapshotAttribute, and ModifySnapshotTier.
  • Azure Monitor Logs
    • Logs changes via Microsoft.Compute/snapshots/write.
  • Google Cloud Logging
    • Captures modifications through compute.snapshots.setIamPolicy and compute.snapshots.patch.
Cluster A Galaxy A Cluster B Galaxy B Level
Snapshot Modification (f1eb6ea9-f3ab-414f-af35-2d5427199984) mitre-data-component Modify Cloud Compute Infrastructure - T1578 (144e007b-e638-431d-a894-45d90c54ab90) Attack Pattern 1
Snapshot Modification (f1eb6ea9-f3ab-414f-af35-2d5427199984) mitre-data-component Transfer Data to Cloud Account - T1537 (d4bdbdea-eaec-4071-b4f9-5105e12ea4b6) Attack Pattern 1