Skip to content

ModifyImageAttribute

AWS

ModifyImageAttribute

service: AWS - EC2
techniques:

Event

Modifies attributes of an AMI, such as making it public or sharing it with specific AWS accounts.

Security Context

  • Impairing defenses allows adversaries to operate freely by removing security controls that would otherwise detect or block their activity.
  • Creating or accessing snapshots and images can expose full disk contents, including credentials, application data, and configuration secrets.
  • Transferring data to external cloud accounts or regions can bypass network-based data loss prevention controls and exfiltrate large volumes of data.

Log Source

CloudTrail

Sample Event

Adversarial — exfiltration. Draco identifies a hardened AMI used by the OCCAMY pipeline (ami-0occamy0base000001) — it contains baked-in agent code, internal CA certs, and a config file with a service-account API key. He calls ModifyImageAttribute to add the adversary-controlled account (555666661337) to the AMI’s launch-permission list. Once shared, he can launch an instance from it in his own account and read everything inside. T1685 (defense-impairment via low-detection-surface AWS API) + T1578 + T1537.

{
"eventVersion": "1.09",
"userIdentity": {
"type": "IAMUser",
"principalId": "AIDADRAC0MALF0YBADGY",
"arn": "arn:aws:iam::555123456789:user/draco",
"accountId": "555123456789",
"accessKeyId": "ASIADRAC0MALF0YEXAMP5",
"userName": "draco",
"sessionContext": {
"attributes": {
"creationDate": "2026-04-15T21:42:08Z",
"mfaAuthenticated": "false"
}
}
},
"eventTime": "2026-04-15T22:41:09Z",
"eventSource": "ec2.amazonaws.com",
"eventName": "ModifyImageAttribute",
"awsRegion": "us-east-1",
"sourceIPAddress": "203.0.113.66",
"userAgent": "aws-cli/1.18.147 Python/3.7.10 Linux/5.4.0-1045-aws botocore/1.18.6",
"requestParameters": {
"imageId": "ami-0occamy0base000001",
"launchPermission": {
"add": {
"items": [
{
"userId": "555666661337"
}
]
}
}
},
"responseElements": {
"requestId": "90000000-0000-4000-8000-000101010100",
"_return": true
},
"requestID": "90000000-0000-4000-8000-000101010100",
"eventID": "90000000-0000-4000-8000-000101010101",
"readOnly": false,
"eventType": "AwsApiCall",
"managementEvent": true,
"recipientAccountId": "555123456789",
"eventCategory": "Management",
"tlsDetails": {
"tlsVersion": "TLSv1.3",
"cipherSuite": "TLS_AES_128_GCM_SHA256",
"clientProvidedHostHeader": "ec2.us-east-1.amazonaws.com"
}
}

MITRE ATT&CK Mapping

Tactics: Collection Exfiltration

Techniques:
  • T1530 — Data from Cloud Storage — Adversaries may access data from cloud storage.
  • T1537 — Transfer Data to Cloud Account — Adversaries may exfiltrate data by transferring the data, including through sharing/syncing and creating backups of cloud environments, to another cloud account they control on the same service.