huntrule

AWS EC2: DisableEbsEncryptionByDefault API call to turn off default EBS encryption

Flags when EC2 default EBS encryption is disabled for the current AWS region via CloudTrail.

FreeReviewedSigma · Medium · v5
Product
aws
Service
cloudtrail
Author
Sittikorn S (SigmaHQ), DRL 1.1
Published
2021-06-29
Updated
2026-07-31
AnalysisDetection

ATT&CK techniques

Impact

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule identifies when an AWS account disables default Amazon EBS encryption for the current region via the EC2 DisableEbsEncryptionByDefault API call. Reducing default encryption can enable newly created EBS volumes to be unencrypted, which is significant for data protection and confidentiality. It relies on AWS CloudTrail event telemetry capturing the eventSource and eventName for this specific EC2 action.

Reporting behind it

Related detections9 linkedT1486 — drag to rearrange
Malicious Interlock Ransomware Encrypted File and Note Creation (via file_event)
Malicious Ransomware Encryption Extension x2anylock
Malicious Fivehands Go Encryptor Execution via Command Line Flags
Malicious SafePay Ransomware Encryptor Command-Line Execution
Malicious The Gentlemen Ransomware Encryptor via Distinctive CLI Flags
Malicious GigaWiper Ransomware File Extension .candy
Malicious Forced BitLocker Encryption for Extortion (via process_creation)
Malicious Volume Shadow Copy Deletion via Vssadmin
Malicious CACTUS Ransomware Note and Encrypted File Artifacts (via file_event)
AWS EC2: DisableEbsEncryptionByDefault API call to turn off default EBS encryption
Pivot detection · T1486 · 9 related

Changelog

v5
  1. v5
    Candidate ingested via manual entry.2026-07-31
  2. v4
    Candidate ingested via manual entry.2026-07-31
  3. v3
    Candidate ingested via manual entry.2026-07-31
  4. v2
    Candidate ingested via manual entry.2026-07-31
  5. v1
    No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.