huntrule

Malicious S3 Object Encryption for Ransom via SSE-C

PremiumReviewedSigma · High · v1
Product
aws
Service
cloudtrail
Author
HuntRule
Published
2026-06-17
Updated
2026-08-28
AnalysisDetection

ATT&CK techniques

Impact

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule detects an S3 PutObject call that supplies a customer provided encryption key using server side encryption with customer keys, the core primitive of the AWS S3 SSE-C ransom scenario emulated by Elastic. By overwriting objects with a key only the attacker holds the adversary makes bucket data unrecoverable to the owner and demands payment. SSE-C on writes is uncommon in most environments and can indicate destructive ransom activity.

Reporting behind it

Related detections9 linkedT1486 — drag to rearrange
Malicious Ransomware Encryption Extension x2anylock
Malicious Fivehands Go Encryptor Execution via Command Line Flags
Malicious SafePay Ransomware Encryptor Command-Line Execution
Malicious The Gentlemen Ransomware Encryptor via Distinctive CLI Flags
Malicious GigaWiper Ransomware File Extension .candy
Malicious Forced BitLocker Encryption for Extortion (via process_creation)
Malicious Volume Shadow Copy Deletion via Vssadmin
Malicious CACTUS Ransomware Note and Encrypted File Artifacts (via file_event)
Malicious Macaw Ransom Note or Encrypted File Written (via file_event)
Malicious S3 Object Encryption for Ransom via SSE-C
Pivot detection · T1486 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.