AWS EC2 Disable Default EBS Encryption in Current Region

Flags when EC2 default EBS encryption is disabled for the current AWS region via CloudTrail.

FreeUnreviewedSigmamediumv1

aws-ec2-disable-default-ebs-encryption-in-current-region-16124c2d

title: AWS EC2 Disable Default EBS Encryption in Current Region
id: 472974e7-3c63-477a-b5cd-f82519afe10e
status: stable
description: Detects the EC2 API action DisableEbsEncryptionByDefault, which turns off default Amazon EBS volume encryption for the current region. Attackers may use this to reduce encryption coverage for newly created volumes, weakening data-at-rest protections. The rule relies on AWS CloudTrail events capturing eventSource and eventName for this API call.
references:
  - https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DisableEbsEncryptionByDefault.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/aws/cloudtrail/aws_ec2_disable_encryption.yml
author: Sittikorn S, Huntrule Team
date: 2021-06-29
modified: 2021-08-20
tags:
  - attack.impact
  - attack.t1486
  - attack.t1565
logsource:
  product: aws
  service: cloudtrail
detection:
  selection:
    eventSource: ec2.amazonaws.com
    eventName: DisableEbsEncryptionByDefault
  condition: selection
falsepositives:
  - System Administrator Activities
  - DEV, UAT, SAT environment. You should apply this rule with PROD account only.
level: medium
license: DRL-1.1
related:
  - id: 16124c2d-e40b-4fcc-8f2c-5ab7870a2223
    type: derived

What it detects

Detects the EC2 API action DisableEbsEncryptionByDefault, which turns off default Amazon EBS volume encryption for the current region. Attackers may use this to reduce encryption coverage for newly created volumes, weakening data-at-rest protections. The rule relies on AWS CloudTrail events capturing eventSource and eventName for this API call.

Known false positives

System Administrator Activities
DEV, UAT, SAT environment. You should apply this rule with PROD account only.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.