An adversary may create a snapshot or data backup within a cloud account to evade defenses. A snapshot is a point-in-time copy of an existing cloud compute component such as a virtual machine (VM), virtual hard drive, or volume. An adversary may leverage permissions to create a snapshot in order to bypass restrictions that prevent access to existing compute service infrastructure, unlike in [Revert Cloud Instance](https://attack.mitre.org/techniques/T1578/004) where an adversary may revert to a snapshot to evade detection and remove evidence of their presence.

An adversary may [Create Cloud Instance](https://attack.mitre.org/techniques/T1578/002), mount one or more created snapshots to that instance, and then apply a policy that allows the adversary access to the created instance, such as a firewall policy that allows them inbound and outbound SSH access.(Citation: Mandiant M-Trends 2020)
Create Snapshot
source_name: mitre-attack  url: https://attack.mitre.org/techniques/T1578/001  external_id: T1578.001     source_name: Mandiant M-Trends 2020  description: Mandiant. (2020, February). M-Trends 2020. Retrieved April 24, 2020.  url: https://content.fireeye.com/m-trends/rpt-m-trends-2020     source_name: AWS Cloud Trail Backup API  description: Amazon. (2020). Logging AWS Backup API Calls with AWS CloudTrail. Retrieved April 27, 2020.  url: https://docs.aws.amazon.com/aws-backup/latest/devguide/logging-using-cloudtrail.html     source_name: Azure - Monitor Logs  description: Microsoft. (2019, June 4). Monitor at scale by using Azure Monitor. Retrieved May 1, 2020.  url: https://docs.microsoft.com/en-us/azure/backup/backup-azure-monitoring-use-azuremonitor     source_name: Cloud Audit Logs  description: Google. (n.d.). Audit Logs. Retrieved June 1, 2020.  url: https://cloud.google.com/logging/docs/audit#admin-activity     source_name: GCP - Creating and Starting a VM  description: Google. (2020, April 23). Creating and Starting a VM instance. Retrieved May 1, 2020.  url: https://cloud.google.com/compute/docs/instances/create-start-instance#api_2     