Modify Cloud Compute Infrastructure: Create Snapshot

Threat Actors may create a snapshot or data backup within a cloud account to evade defenses. A snapshot is a point-in-time copy of an existing cloud compute component such as a virtual machine (VM), virtual hard drive, or volume. Threat Actors may leverage permissions to create a snapshot in order to bypass restrictions that prevent access to existing compute service infrastructure, unlike in Revert Cloud Instancewhere Threat Actors may revert to a snapshot to evade detection and remove evidence of their presence.