AWS EC2 Disable EBS Encryption

Status: stable
Severity: medium
Log source: product aws, service cloudtrail
Author: Sittikorn S
Source: github.com/SigmaHQ/sigma

Identifies disabling of default Amazon Elastic Block Store (EBS) encryption in the current region. Disabling default encryption does not change the encryption status of your existing volumes.

Known false positives

System Administrator Activities
DEV, UAT, SAT environment. You should apply this rule with PROD account only.

MITRE ATT&CK coverage

Tactic	Techniques
Impact	`T1486` Data Encrypted for Impact `T1565` Data Manipulation

Telemetry coverage

Platform	Record / event type
AWS	CloudTrail event `DisableEbsEncryptionByDefault`: Disables default EBS encryption for EBS volumes created in the current account and Region.

Rules detecting the same action

These rules filter on the same operation.

AWS EC2 EBS Encryption Disabled (Panther)
AWS EC2 Encryption Disabled (Elastic)

Rule body

title: AWS EC2 Disable EBS Encryption
id: 16124c2d-e40b-4fcc-8f2c-5ab7870a2223
status: stable
description: |
  Identifies disabling of default Amazon Elastic Block Store (EBS) encryption in the current region.
  Disabling default encryption does not change the encryption status of your existing volumes.
references:
    - https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DisableEbsEncryptionByDefault.html
author: Sittikorn S
date: 2021-06-29
modified: 2021-08-20
tags:
    - attack.impact
    - attack.t1486
    - attack.t1565
logsource:
    product: aws
    service: cloudtrail
detection:
    selection:
        eventSource: ec2.amazonaws.com
        eventName: DisableEbsEncryptionByDefault
    condition: selection
falsepositives:
    - System Administrator Activities
    - DEV, UAT, SAT environment. You should apply this rule with PROD account only.
level: medium

Stages and Predicates

Stage 0: `condition`

selection

Stage 1: `selection`

selection:
    eventSource: ec2.amazonaws.com
    eventName: DisableEbsEncryptionByDefault

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`eventName`	eq	`DisableEbsEncryptionByDefault`	`field:"aws::eventName" kind:eq value:"DisableEbsEncryptionByDefault"`
`eventSource`	eq	`ec2.amazonaws.com`	`field:"aws::eventSource" kind:eq value:"ec2.amazonaws.com"`