[New Rule][Deprecation] AWS EC2 Export Task Rules

[imays11]

Pull Request

Issue link(s):

• https://github.com/elastic/ia-trade-team/issues/616

Summary - What I changed

Deprecate - AWS EC2 VM Export Failure

Starting Deprecation process for this rule. I cannot see the value in alerting on a failed VM export attempt. This is rare behavior in general but failed attempts don't warrant an alert especially considering we have no coverage for an actual successful VM Export. This rule has had no alerts in telemetry, I've seen no hits in prod data either. VM exports have a very specific use-case, they can be used to create VM image files that can be downloaded and used to run a VM locally. Successful exports warrant an alert.

New Rule - AWS EC2 Export Task

This new rule is meant to fill the previously mentioned gap regarding successful VM exports. But also includes other forms of EC2 export tasks: CreateImageExportTask , ExportImage, CreateStoreImageTask

Threat rationale

These APIs are uncommon in day-to-day operations, so successful events (not failures) are higher-signal behaviors that should be investigated. Successful exports create portable images of systems and data, enabling:

• Data exfiltration to external buckets/accounts or on-prem.
• Collection of offline analysis/reuse of sensitive configs, keys, or code.

Definitions

• AMI: the bootable template for EC2 (metadata + references to one or more EBS snapshots). Can be exported or stored to S3.
• EBS snapshot: point-in-time, incremental copy of a volume (backed by S3 internally but not directly accessible via S3 APIs). AMIs for EBS-backed instances are built from snapshots. We have rule coverage on sharing EBS Snapshots externally.

What’s being exported (and why it matters)

• EC2 instance > VM file in S3 (CreateInstanceExportTask) ref
  Produces an OVA/VMDK runnable outside AWS. Effectively lifting a full server image (OS, apps, configs, sometimes data).
• AMI > VM file in S3 (ExportImage) ref
  Exfiltrates a bootable image built from EBS snapshots for reuse or offline analysis elsewhere.
• AMI > single S3 object (CreateStoreImageTask) ref
  Stores the AMI as an S3 object that can be copied out of the account/partition.

How To Test

This script will trigger ExportImage and CreateStoreImageTask by default. However, CreateInstanceExportTask only succeeds for instances that originated from an imported VM image so I was not able to test this API call explicitly.

Screenshot Working Query

[github-actions]

Rule: New - Guidelines

These guidelines serve as a reminder set of considerations when proposing a new rule.

Documentation and Context

• Detailed description of the rule.
• List any new fields required in ECS/data sources.
• Link related issues or PRs.
• Include references.

Rule Metadata Checks

• creation_date matches the date of creation PR initially merged.
• min_stack_version should support the widest stack versions.
• name and description should be descriptive and not include typos.
• query should be inclusive, not overly exclusive, considering performance for diverse environments. Non ecs fields should be added to non-ecs-schema.json if not available in an integration.
• min_stack_comments and min_stack_version should be included if the rule is only compatible starting from a specific stack version.
• index pattern should be neither too specific nor too vague, ensuring it accurately matches the relevant data stream (e.g., use logs-endpoint.process-* for process data).
• integration should align with the index. If the integration is newly introduced, ensure the manifest, schemas, and new_rule.yaml template are updated.
• setup should include the necessary steps to configure the integration.
• note should include any additional information (e.g. Triage and analysis investigation guides, timeline templates).
• tags should be relevant to the threat and align/added to the EXPECTED_RULE_TAGS in the definitions.py file.
• threat, techniques, and subtechniques should map to ATT&CK always if possible.

New BBR Rules

• building_block_type should be included if the rule is a building block and the rule should be located in the rules_building_block folder.
• bypass_bbr_timing should be included if adding custom lookback timing to the rule.

Testing and Validation

• Provide evidence of testing and detecting the expected threat.
• Check for existence of coverage to prevent duplication.

[terrancedejesus]

Deprecate - --> Deprecated -