T1578.001 — Create Snapshot

Tactic: Defense Impairment · Platforms: IaaS

An adversary may create a snapshot or data backup within a cloud account to evade defenses. A snapshot is a point-in-time copy of an existing cloud compute component such as a virtual machine (VM), virtual hard drive, or volume. An adversary may leverage permissions to create a snapshot in order…

Sub-technique of Modify Cloud Compute Infrastructure (T1578).

Sigma detection rules (1)

T1578.001 Modify Cloud Compute Infrastructure: Create Snapshot

title: "T1578.001 Modify Cloud Compute Infrastructure: Create Snapshot"
id: af9cfbba-ea0a-4f1d-86d7-ef876e128d7e
description: 'Detection Strategy for Modify Cloud Compute Infrastructure: Create Snapshot. (Retargeted to the cloudtrail AWS telemetry that actually captures this techniques behavior; see logsource below.) Tune using: UserContext, TimeWindow, GeoLocation, VolumeSensitivity.'
references:
  - https://attack.mitre.org/techniques/T1578/001
author: Shahrukh Khan
date: 2026-06-18
license: MIT
tags:
  - attack.defense-impairment
  - attack.t1578.001

logsource:
  category: cloudtrail
  product: aws

detection:
  selection:
    eventSource: 'ec2.amazonaws.com'
    eventName: 'CreateSnapshot'

  condition: selection

falsepositives:
  - Routine automated backup jobs creating EBS snapshots on a recurring schedule.

level: low

Related sub-techniques

Explore