Create Snapshot (T1578.001): Cloud Defense Evasion

Create Snapshot (T1578.001) is a sub-technique of Modify Cloud Compute Infrastructure in the defense impairment tactic, for IaaS. The adversary creates a snapshot or backup inside a cloud account to evade defenses. A snapshot is a point-in-time copy of a compute component such as a virtual machine, a virtual hard drive or a volume.

MITRE explains the angle: the adversary uses permissions to create a snapshot so they can bypass restrictions that prevent access to the existing compute infrastructure. This is different from Revert Cloud Instance (T1578.004), where the goal is to roll back to a snapshot to remove evidence.

How attackers use it

MITRE describes a chain. The adversary creates a snapshot of a target volume, then creates a new instance (T1578.002), mounts the snapshot on it and applies a policy that gives them access. MITRE's example is a firewall policy that allows inbound and outbound SSH. The data now sits on a machine the adversary controls inside the victim's account, where controls tied to the original instance do not apply.

Nothing in that chain needs malware. It needs permissions and a few API calls.

How to detect it

MITRE's analytic correlates snapshot creation with the instance activity that follows. Suspicious sequences include:

• Snapshots created by unexpected or newly created IAM users
• Snapshots taken from sensitive volumes with no preceding change control activity
• A snapshot immediately followed by a mount on an unauthorized instance

Cross-reference with user behavior, IP geolocation and automation context. That context separates a normal backup job from an adversary-driven copy.

Practical steps: list your backup identities and schedules so that anything else stands out, and watch for new instances that attach volumes created from snapshots within minutes of creation.

How to reduce the risk

MITRE lists two mitigations.

1. Audit. Routinely check user permissions so only expected identities can create snapshots and backups.
2. User account management. Limit snapshot and backup permissions according to least privilege. Keep the count of administrative IAM roles low, reduce permanent privileged assignments, and review entitlements on a schedule.

Check your own environment

# AWS CLI: snapshots you own, newest information first in the table
aws ec2 describe-snapshots --owner-ids self --query 'Snapshots[].[SnapshotId,StartTime,VolumeId]' --output table

# AWS CLI: who created snapshots recently
aws cloudtrail lookup-events --lookup-attributes AttributeKey=EventName,AttributeValue=CreateSnapshot --max-results 20

• Which identities hold snapshot creation rights, and do they match your backup design?
• Are snapshots of sensitive volumes encrypted, with key access limited?
• Does an alert fire when a snapshot is followed by a new instance in the same account?

Quick check

Sources

• MITRE ATT&CK T1578.001: Create Snapshot