AWS EC2 Disable EBS Encryption — Sigma Rule

Rule metadata and linked tags

Author: Sittikorn S. Source status: stable; severity: medium. Source dates: 2021-06-29 / 2021-08-20.

{
  "product": "aws",
  "service": "cloudtrail"
}

Pinned original Sigma rule · Detection Rule License 1.1

Source SHA-256: 32d77e9feddfa6e6eb2b217d64ce4ec8f0c5a4a790a49579c5af2d57b61f3836

Detection logic

Original source YAML. Source-tag agreement is not proof of complete semantic coverage. This rule has not been compiled for a SIEM backend or validated against live telemetry here.

title: AWS EC2 Disable EBS Encryption
id: 16124c2d-e40b-4fcc-8f2c-5ab7870a2223
status: stable
description: |
  Identifies disabling of default Amazon Elastic Block Store (EBS) encryption in the current region.
  Disabling default encryption does not change the encryption status of your existing volumes.
references:
    - https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DisableEbsEncryptionByDefault.html
author: Sittikorn S
date: 2021-06-29
modified: 2021-08-20
tags:
    - attack.impact
    - attack.t1486
    - attack.t1565
logsource:
    product: aws
    service: cloudtrail
detection:
    selection:
        eventSource: ec2.amazonaws.com
        eventName: DisableEbsEncryptionByDefault
    condition: selection
falsepositives:
    - System Administrator Activities
    - DEV, UAT, SAT environment. You should apply this rule with PROD account only.
level: medium

Original YAML and metadata in JSON

False positives

• System Administrator Activities
• DEV, UAT, SAT environment. You should apply this rule with PROD account only.

Source references

• https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DisableEbsEncryptionByDefault.html