Malicious AWS EC2 Disable EBS Encryption (via cloudtrail)

title: Malicious AWS EC2 Disable EBS Encryption (via cloudtrail)
id: da9fdb9c-ffd4-5340-af63-07bc1700eb7c
status: stable
description: This rule detects disabling of default Amazon Elastic Block Store (EBS) encryption in the current region. Disabling default encryption does not change the encryption status of your existing volumes.
references:
    - https://attack.mitre.org/techniques/T1565/
    - https://attack.mitre.org/techniques/T1486/
    - https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DisableEbsEncryptionByDefault.html
author: Huntrule Team
date: 2026-05-31
tags:
    - attack.impact
    - attack.t1486
    - attack.t1565
logsource:
    product: aws
    service: cloudtrail
detection:
    selection:
        eventSource: ec2.amazonaws.com
        eventName: DisableEbsEncryptionByDefault
    condition: selection
falsepositives:
    - Unknown
level: medium