StartExportTask
AWS
StartExportTask
Event
Starts an export of an RDS snapshot to Amazon S3 in Apache Parquet format for use in analytics.
Security Context
- Accessing cloud storage objects can expose sensitive data including backups, configuration files, application data, and customer information.
- Transferring data to external cloud accounts or regions can bypass network-based data loss prevention controls and exfiltrate large volumes of data.
Log Source
CloudTrail
Sample Event
Adversarial. Draco starts an RDS snapshot export task targeting the destination fantasticlogs-niffler-archive S3 bucket — but with the prefix customers/2026-q1/ and a fake task identifier phoenix-quarterly-export-2026-q1. The export role he uses (OccamyPipelineRole, persona role) has S3 write access to the data lake, so the export lands in the same bucket the legitimate analytics pipeline writes to — making it harder to detect. From there he can s3:GetObject the parquet files (or, in the broader chain, copy them to draco-exfil-bucket-666 as in the pilot’s aws-copyobject). T1537 / T1530.
{ "eventVersion": "1.09", "userIdentity": { "type": "IAMUser", "principalId": "AIDADRAC0MALF0YBADGY", "arn": "arn:aws:iam::555123456789:user/draco", "accountId": "555123456789", "accessKeyId": "AKIADRAC0MALF0YEXAMP5", "userName": "draco", "sessionContext": { "attributes": { "creationDate": "2026-04-15T18:51:02Z", "mfaAuthenticated": "false" } } }, "eventTime": "2026-04-15T20:55:27Z", "eventSource": "rds.amazonaws.com", "eventName": "StartExportTask", "awsRegion": "us-east-1", "sourceIPAddress": "203.0.113.66", "userAgent": "aws-cli/1.18.147 Python/3.7.10 Linux/5.4.0-1045-aws botocore/1.18.6", "requestParameters": { "exportTaskIdentifier": "phoenix-quarterly-export-2026-q1", "sourceArn": "arn:aws:rds:us-east-1:555123456789:snapshot:phoenix-prod-db-snapshot-2026-04-12", "s3BucketName": "fantasticlogs-niffler-archive", "iamRoleArn": "arn:aws:iam::555123456789:role/OccamyPipelineRole", "kmsKeyId": "arn:aws:kms:us-east-1:555123456789:key/60000000-0000-4000-8000-000000000001", "s3Prefix": "customers/2026-q1/" }, "responseElements": { "exportTaskIdentifier": "phoenix-quarterly-export-2026-q1", "sourceArn": "arn:aws:rds:us-east-1:555123456789:snapshot:phoenix-prod-db-snapshot-2026-04-12", "s3Bucket": "fantasticlogs-niffler-archive", "s3Prefix": "customers/2026-q1/", "iamRoleArn": "arn:aws:iam::555123456789:role/OccamyPipelineRole", "kmsKeyId": "arn:aws:kms:us-east-1:555123456789:key/60000000-0000-4000-8000-000000000001", "status": "STARTING", "percentProgress": 0, "totalExtractedDataInGB": 0, "snapshotTime": "Apr 12, 2026 6:00:00 AM", "taskStartTime": "Apr 15, 2026 8:55:27 PM" }, "requestID": "90000000-0000-4000-8000-000110110100", "eventID": "90000000-0000-4000-8000-000110110101", "readOnly": false, "eventType": "AwsApiCall", "managementEvent": true, "recipientAccountId": "555123456789", "eventCategory": "Management", "tlsDetails": { "tlsVersion": "TLSv1.3", "cipherSuite": "TLS_AES_128_GCM_SHA256", "clientProvidedHostHeader": "rds.us-east-1.amazonaws.com" }}MITRE ATT&CK Mapping
Tactics: Exfiltration Collection
Techniques:
- T1537 — Transfer Data to Cloud Account — Adversaries may exfiltrate data by transferring the data, including through sharing/syncing and creating backups of cloud environments, to another cloud account they control on the same service.
- T1530 — Data from Cloud Storage — Adversaries may access data from cloud storage.