C-RDS-SNAPSHOTCollection

RDS / Azure-SQL Snapshot Share

CreateDBSnapshot then ModifyDBSnapshotAttribute to share to an attacker-owned account — clone DB outside victim tenancy.

§ Where this technique fits

C-RDS-SNAPSHOT is catalogued under the Collection tactic of the offensive-security kill-chain. It appears in 0 approved dossiers in the registry, typically.