AWS EC2: DisableEbsEncryptionByDefault API call to turn off default EBS encryption

Flags when EC2 default EBS encryption is disabled for the current AWS region via CloudTrail.

FreeReviewedSigma · Medium · v5

Product: aws
Service: cloudtrail
Author: Sittikorn S (SigmaHQ), DRL 1.1
Published: 2021-06-29
Updated: 2026-07-31

ATT&CK techniques

Impact

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
- T1486Data Encrypted for Impact
- T1565Data Manipulation

What it detects

This rule identifies when an AWS account disables default Amazon EBS encryption for the current region via the EC2 DisableEbsEncryptionByDefault API call. Reducing default encryption can enable newly created EBS volumes to be unencrypted, which is significant for data protection and confidentiality. It relies on AWS CloudTrail event telemetry capturing the eventSource and eventName for this specific EC2 action.

Reporting behind it

Related detections9 linkedT1486 — drag to rearrange

Malicious Interlock Ransomware Encrypted File and Note Creation (via file_event)

Malicious Ransomware Encryption Extension x2anylock

Malicious Fivehands Go Encryptor Execution via Command Line Flags

Malicious SafePay Ransomware Encryptor Command-Line Execution

Malicious The Gentlemen Ransomware Encryptor via Distinctive CLI Flags

Malicious GigaWiper Ransomware File Extension .candy

Malicious Forced BitLocker Encryption for Extortion (via process_creation)

Malicious Volume Shadow Copy Deletion via Vssadmin

Malicious CACTUS Ransomware Note and Encrypted File Artifacts (via file_event)

AWS EC2: DisableEbsEncryptionByDefault API call to turn off default EBS encryption

Pivot detection · T1486 · 9 related

Changelog

v5
Candidate ingested via manual entry.2026-07-31
v4
Candidate ingested via manual entry.2026-07-31
v3
Candidate ingested via manual entry.2026-07-31
v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

aws-ec2-disable-default-ebs-encryption-in-current-region-16124c2d

title: "AWS EC2: DisableEbsEncryptionByDefault API call to turn off default EBS encryption"
id: 472974e7-3c63-477a-b5cd-f82519afe10e
status: stable
description: This rule identifies when an AWS account disables default Amazon EBS encryption for the current region via the EC2 DisableEbsEncryptionByDefault API call. Reducing default encryption can enable newly created EBS volumes to be unencrypted, which is significant for data protection and confidentiality. It relies on AWS CloudTrail event telemetry capturing the eventSource and eventName for this specific EC2 action.
references:
  - https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DisableEbsEncryptionByDefault.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/aws/cloudtrail/aws_ec2_disable_encryption.yml
author: Sittikorn S, Huntrule Team
date: 2021-06-29
modified: 2021-08-20
tags:
  - attack.impact
  - attack.t1486
  - attack.t1565
logsource:
  product: aws
  service: cloudtrail
detection:
  selection:
    eventSource: ec2.amazonaws.com
    eventName: DisableEbsEncryptionByDefault
  condition: selection
falsepositives:
  - System Administrator Activities
  - DEV, UAT, SAT environment. You should apply this rule with PROD account only.
level: medium
license: DRL-1.1
related:
  - id: 16124c2d-e40b-4fcc-8f2c-5ab7870a2223
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL