Query: alert when An attempt to export an AWS EC2 instance has been detected. A VM Export might indicate an attempt to extract information
Matching passage: Sigma rule: An attempt to export an AWS EC2 instance has been detected. A VM Export might indicate an attempt to extract information. Logsource: aws / cloudtrail. Rule: title: AWS EC2 VM Export Failure id: 54b9a76a-3c71-4673-b4b3-2edb4566ea7b status: test description: An attempt to export an AWS EC2 instance has been detected. A VM Export might indicate an attempt to extract information from an instance. references: - https://docs.aws.amazon.com/vm-import/latest/userguide/vmexport.html#export-instance author: Diogo Braz date: 2020-04-16 modified: 2022-10-05 tags: - attack.collection - attack.t1005 - attack.exfiltration - attack.t1537 logsource: product: aws service: cloudtrail detection: selection: eventName: CreateInstanceExportTask eventSource: ec2.amazonaws.com filter1: errorMessage|contains: '*' filter2: errorCode|contains: '*' filter3: responseElements|contains: Failure condition: selection and not 1 of filter* level: low
Near-miss passage: Sigma rule: Detects potential abuse of WerFaultSecure.exe to dump Protected Process Light (PPL) processes like LSASS or to freeze se. Logsource: windows / process_creation. Rule: title: PPL Tampering Via WerFaultSecure id: 1f0b4cac-9c81-41f4-95d0-8475ff46b3e2 related: - id: 387df17d-3b04-448f-8669-9e7fd5e5fd8c type: similar - id: 8a2f4b1c-3d5e-4f7a-9b2c-1e4f6d8a9c2b type: similar status: experimental description: 'Detects potential abuse of WerFaultSecure.exe to dump Protected Process Light (PPL) processes like LSASS or to freeze security solutions (EDR/antivirus). This technique is used by tools such as EDR-Freeze and WSASS to bypass PPL protections and access sensitive information or disable security software. Distinct command line patterns help identify the specific tool: - WSASS usage typically shows: "WSASS.exe WerFaultSecure.exe [PID]" in ParentCommandLine - EDR-Freeze usage typically shows: "EDR-Freeze_[version].exe [PID] [timeout]" in ParentCommandLine Legitimate debugging operations using WerFaultSecure are rare in production environments and should be investigated. ' references: - https://www.zerosalarium.com/2025/09/EDR-Freeze-Puts-EDRs-Antivirus-Into-Coma.html - https://github.com/TwoSevenOneT/EDR-Freeze/blob/a7f61030b36fbde89871f393488f7075d2aa89f6/EDR-Freeze.cpp#L53 - https://www.zerosalarium.com/2025/09/Dumping-LSASS-With-WER-On-Modern-Windows-11.html - https://github.com/TwoSevenOneT/WSASS/blob/2c8fd9fa32143e7bc9f066e9511c6f8a57bc64b5/WSASS.cpp#L251 author: Jason (https://github.com/0xbcf) date: 2025-09-23 modified: 2025-11-23 tags: - attack.defense-impairment - attack.t1685 - attack.credential-access - attack.t1003.001 logsource: category: process_creation product: windows detection: selection_image: - Image|endswith: \WerFaultSecure.exe - OriginalFileName: WerFaultSecure.exe selection_args: CommandLine|contains|all: - ' /h ' - ' /pid ' - ' /tid ' - ' /encfile ' - ' /cancel ' - ' /type ' - ' 268310' condition: all of selection_* falsepositives: - Legitimate usage of WerFaultSecure for debugging purposes level: high regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_werfaultsecure_abuse/info.yml