tfMITRE ATT&CK sub-technique

Create Snapshot T1578.001

sub-technique of T1578 Modify Cloud Compute Infrastructure

Tactic: Defense Impairment
Platform: IaaS
Version: 2.0
Created: 09 June 2020
Last modified: 12 May 2026
Contributor: Praetorian

An adversary may create a snapshot or data backup within a cloud account to evade defenses. A snapshot is a point-in-time copy of an existing cloud compute component such as a virtual machine (VM), virtual hard drive, or volume. An adversary may leverage permissions to create a snapshot in order to bypass restrictions that prevent access to existing compute service infrastructure, unlike in Revert Cloud Instance where an adversary may revert to a snapshot to evade detection and remove evidence of their presence.

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groupsNone recorded

Threat groupsNone recorded · 29% of ATT&CK techniques have none either.

CampaignsNone recorded

CampaignsNone recorded · 54% of ATT&CK techniques have none either.

Tools & malware44th pct

Tools & malware44th percentile · 56% of ATT&CK techniques have more tools implementing them.

Detection rulesNone recorded

Detection rulesNone recorded · 33% of ATT&CK techniques have none either.

Create Snapshot MITRE reference T1578.001

44th pctamong all ATT&CK techniques for number of tools

1 software entry is documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.

PacuS1091 ↗

Can create snapshots of EBS volumes and RDS instances.1

created 2023-09-28TOOL

All 1 software entries for this technique

Offense vs defense T1578.001

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

Create Snapshot detection strategy DET0423

MITRE names one behaviour worth catching for this technique and breaks it into 1 analytic, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Detection Strategy for Modify Cloud Compute Infrastructure: Create Snapshot

Enterprise

1 platform

AN1187 · IaaS

Detection focuses on correlating snapshot creation events with subsequent instance creation and mounting activities. From a defender perspective, suspicious sequences include snapshot creation by unexpected or newly created IAM users, snapshots created from sensitive volumes without preceding change-control activity, or snapshots immediately followed by mounting to unauthorized instances. Cross-referencing with user behavior, IP geolocation, and automation context helps distinguish benign backup operations from adversary-driven snapshot exploitation.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Snapshot CreationDC0057	AWS:CloudTrail	CreateSnapshot
Snapshot MetadataDC0062	AWS:CloudTrail	DescribeSnapshots

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
UserContext	IAM user, service account, or role performing snapshot creation. Tuned to allowlist known backup automation services.
TimeWindow	Frequency of snapshot creation in a defined period. Adjusted for environments with frequent automated backups.
GeoLocation	Unusual regions or IPs from which snapshot creation API calls originate. Helps identify cross-region snapshot abuse.
VolumeSensitivity	Tagging or classification of volumes being snapshotted. Tuned to prioritize alerts when sensitive volumes are copied.

Tests3Executorssh 3Need elevation0 of 3Have prerequisites3Have cleanup3Platformsiaas:aws, iaas:azure, iaas:gcp

Test

Platform

Executor

Elevation

Prereqs

Cleanup

Ref

AWS - Create Snapshot from EBS Volume

iaas:aws

—

Yes

Creates an EBS snapshot in AWS using the AWS CLI. This simulates an adversary duplicating volume data via snapshots for persistence or exfiltration.

Input arguments

Name	Type	Default	Description
aws_region	string	us-east-1	AWS region where the volume is located.
aws_volume_id	string	vol-0123456789abcdef0	The AWS EBS Volume ID to create a snapshot from.

Attack command

aws ec2 create-snapshot --region #{aws_region} --volume-id #{aws_volume_id} --description "Atomic Red Team Test Snapshot" --query "SnapshotId" --output text

Cleanup command

SNAPSHOT_ID=$(aws ec2 describe-snapshots --region #{aws_region} --filters "Name=volume-id,Values=#{aws_volume_id}" --query "Snapshots[0].SnapshotId" --output text)
if [ "$SNAPSHOT_ID" != "None" ]; then
  aws ec2 delete-snapshot --region #{aws_region} --snapshot-id "$SNAPSHOT_ID"
fi

Prerequisite

AWS CLI must be installed.

Check

if command -v aws > /dev/null 2>&1; then exit 0; else exit 1; fi

Satisfy

echo "Install AWS CLI: https://docs.aws.amazon.com/cli/latest/userguide/install-cliv2.html"

Prerequisite

AWS CLI must be authenticated.

Check

if aws sts get-caller-identity --region #{aws_region} > /dev/null 2>&1; then exit 0; else exit 1; fi

Satisfy

echo "Configure AWS credentials with: aws configure"

Prerequisite

EBS volume must exist.

Check

if aws ec2 describe-volumes --volume-ids #{aws_volume_id} --region #{aws_region} > /dev/null 2>&1; then exit 0; else exit 1; fi

Satisfy

echo "Ensure the volume ID exists in the target AWS account and region."

GUIDbd0fc28b-f0b5-4d40-8007-14a0a19e819f

Azure - Create Snapshot from Managed Disk

iaas:azure

—

Yes

Creates a snapshot of a managed disk in Azure using the Azure CLI. Simulates adversary snapshotting behavior for persistence or data duplication.

Input arguments

Name	Type	Default	Description
azure_disk_name	string	myDiskName	The Azure disk name.
azure_snapshot_name	string	mySnapshotName	The Azure snapshot name.
azure_resource_group	string	myResourceGroup	The Azure resource group where the disk is located.

Attack command

az snapshot create --resource-group #{azure_resource_group} --name #{azure_snapshot_name} --source #{azure_disk_name} --location eastus

Cleanup command

az snapshot delete --resource-group #{azure_resource_group} --name #{azure_snapshot_name}

Prerequisite

Azure CLI must be installed.

Check

if command -v az > /dev/null 2>&1; then exit 0; else exit 1; fi

Satisfy

echo "Install Azure CLI: https://learn.microsoft.com/en-us/cli/azure/install-azure-cli"

Prerequisite

Azure CLI must be authenticated.

Check

if az account show > /dev/null 2>&1; then exit 0; else exit 1; fi

Satisfy

echo "Login with: az login"

Prerequisite

Azure disk must exist.

Check

if az disk show --resource-group #{azure_resource_group} --name #{azure_disk_name} > /dev/null 2>&1; then exit 0; else exit 1; fi

Satisfy

echo "Ensure the disk exists in the given resource group."

GUID6a97755c-7198-4e5e-9a74-ad1353c63ede

GCP - Create Snapshot from Persistent Disk

iaas:gcp

—

Yes

Creates a snapshot of a persistent disk in GCP using the gcloud CLI. Emulates adversary behavior to gain access to volume data or replicate environment state.

Input arguments

Name	Type	Default	Description
gcp_zone	string	us-central1-a	The Google Cloud zone where the disk is located.
gcp_disk_name	string	myDiskName	The Google Cloud disk name.
gcp_snapshot_name	string	mySnapshotName	The Google Cloud snapshot name.

Attack command

gcloud compute snapshots create #{gcp_snapshot_name} --source-disk=#{gcp_disk_name} --zone=#{gcp_zone}

Cleanup command

gcloud compute snapshots delete #{gcp_snapshot_name} --quiet

Prerequisite

gcloud CLI must be installed.

Check

if command -v gcloud > /dev/null 2>&1; then exit 0; else exit 1; fi

Satisfy

echo "Install gcloud CLI: https://cloud.google.com/sdk/docs/install"

Prerequisite

gcloud CLI must be authenticated.

Check

if gcloud auth list --filter=status:ACTIVE --format="value(account)" | grep . > /dev/null; then exit 0; else exit 1; fi

Satisfy

echo "Authenticate with: gcloud auth login"

Prerequisite

GCP disk must exist.

Check

if gcloud compute disks describe #{gcp_disk_name} --zone=#{gcp_zone} > /dev/null 2>&1; then exit 0; else exit 1; fi

Satisfy

echo "Ensure the disk exists in the specified zone."

GUIDa8328331-1336-4259-9118-408a28a91e1a

Tests from Atomic Red Team (MIT licence) · technique definition

Create Snapshot detections T1578.001

No detection rules are mapped to this technique yet.

None recorded— 33% of ATT&CK techniques have none either

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs