Detectionmediumstable

AWS EC2 Disable EBS Encryption

Identifies disabling of default Amazon Elastic Block Store (EBS) encryption in the current region. Disabling default encryption does not change the encryption status of your existing volumes.

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch

Sittikorn SCreated Tue Jun 29Updated Fri Aug 2016124c2d-e40b-4fcc-8f2c-5ab7870a2223cloud

Log Source

AWScloudtrail

ProductAWS← raw: aws

Servicecloudtrail← raw: cloudtrail

Detection Logic

detection:
    selection:
        eventSource: ec2.amazonaws.com
        eventName: DisableEbsEncryptionByDefault
    condition: selection

False Positives

System Administrator Activities

DEV, UAT, SAT environment. You should apply this rule with PROD account only.

References

Resolving title…

docs.aws.amazon.com

MITRE ATT&CK

Tactics

TA0040 · Impact

Techniques

T1486 · Data Encrypted for Impact T1565 · Data Manipulation

Rule Metadata

Rule ID

16124c2d-e40b-4fcc-8f2c-5ab7870a2223

Status

stable

Level

medium

Type

Detection

Created

Tue Jun 29

Modified

Fri Aug 20

Author

Sittikorn S

Path

rules/cloud/aws/cloudtrail/aws_ec2_disable_encryption.yml

Raw Tags

attack.impactattack.t1486attack.t1565

View on GitHub