{"id":"16124c2d-e40b-4fcc-8f2c-5ab7870a2223","title":"AWS EC2 Disable EBS Encryption","description":"Identifies disabling of default Amazon Elastic Block Store (EBS) encryption in the current region.\nDisabling default encryption does not change the encryption status of your existing volumes.\n","author":"Sittikorn S","status":"stable","level":"medium","date":"2021-06-29","modified":"2021-08-20","tags":["attack.impact","attack.t1486","attack.t1565"],"technique_ids":["T1486","T1565"],"logsource":{"product":"aws","service":"cloudtrail"},"falsepositives":["System Administrator Activities","DEV, UAT, SAT environment. You should apply this rule with PROD account only."],"references":["https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DisableEbsEncryptionByDefault.html"],"source_path":"rules/cloud/aws/cloudtrail/aws_ec2_disable_encryption.yml","source_sha256":"32d77e9feddfa6e6eb2b217d64ce4ec8f0c5a4a790a49579c5af2d57b61f3836","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/cloud/aws/cloudtrail/aws_ec2_disable_encryption.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: AWS EC2 Disable EBS Encryption\nid: 16124c2d-e40b-4fcc-8f2c-5ab7870a2223\nstatus: stable\ndescription: |\n  Identifies disabling of default Amazon Elastic Block Store (EBS) encryption in the current region.\n  Disabling default encryption does not change the encryption status of your existing volumes.\nreferences:\n    - https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DisableEbsEncryptionByDefault.html\nauthor: Sittikorn S\ndate: 2021-06-29\nmodified: 2021-08-20\ntags:\n    - attack.impact\n    - attack.t1486\n    - attack.t1565\nlogsource:\n    product: aws\n    service: cloudtrail\ndetection:\n    selection:\n        eventSource: ec2.amazonaws.com\n        eventName: DisableEbsEncryptionByDefault\n    condition: selection\nfalsepositives:\n    - System Administrator Activities\n    - DEV, UAT, SAT environment. You should apply this rule with PROD account only.\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1486","id":"T1486","name":"Data Encrypted for Impact","page":"techniques/enterprise/T1486/"},{"key":"enterprise/T1565","id":"T1565","name":"Data Manipulation","page":"techniques/enterprise/T1565/"}],"data_path":"data/detection-rules/16124c2d-e40b-4fcc-8f2c-5ab7870a2223.json","kind":"sigma"}