New attack technique: Snapshot existing volume and attach to compromised EC2 instance

[christophetd]

Technique 1 from https://unit42.paloaltonetworks.com/cloud-lateral-movement-techniques/#post-132775-_p1el9vu0ltrs