{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/products/elastic-block-store-ebs/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Elastic Block Store (EBS)"],"_cs_severities":["medium"],"_cs_tags":["aws","ebs","encryption","cloudtrail"],"_cs_type":"advisory","_cs_vendors":["Amazon"],"content_html":"\u003cp\u003eThis detection identifies instances where Amazon Elastic Block Store (EBS) encryption by default is disabled within an AWS region. The default encryption ensures that all new EBS volumes and snapshots are automatically encrypted, protecting data at rest. Disabling this setting, detected via CloudTrail logs, introduces a significant security risk.  Attackers may disable encryption to weaken data protection measures before initiating data exfiltration or tampering with EBS volumes and snapshots. This action can serve as a precursor to data theft or ransomware attacks, as unencrypted volumes are easier to compromise. The rule focuses on the \u003ccode\u003eDisableEbsEncryptionByDefault\u003c/code\u003e event logged by CloudTrail when this configuration change occurs. Elastic has released this rule as part of their detection ruleset on 2026-04-10.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAn attacker gains access to an AWS account, potentially through compromised credentials or a misconfigured IAM role.\u003c/li\u003e\n\u003cli\u003eThe attacker uses the AWS CLI or API to execute the \u003ccode\u003eDisableEbsEncryptionByDefault\u003c/code\u003e command, targeting a specific AWS region.\u003c/li\u003e\n\u003cli\u003eCloudTrail logs the \u003ccode\u003eDisableEbsEncryptionByDefault\u003c/code\u003e event, indicating that default EBS encryption has been disabled.\u003c/li\u003e\n\u003cli\u003eThe attacker creates new EBS volumes within the affected region, which are now unencrypted by default.\u003c/li\u003e\n\u003cli\u003eSensitive data is stored on these newly created, unencrypted EBS volumes.\u003c/li\u003e\n\u003cli\u003eThe attacker exfiltrates the data from the unencrypted EBS volumes to an external location.\u003c/li\u003e\n\u003cli\u003eAlternatively, the attacker might deploy ransomware on instances using the unencrypted volumes, encrypting the data and demanding a ransom.\u003c/li\u003e\n\u003cli\u003eThe attacker covers their tracks by deleting or modifying CloudTrail logs, if possible, to hide their activity.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eDisabling EBS encryption by default can lead to the creation of unencrypted EBS volumes, exposing sensitive data at rest. A successful attack could result in data theft, data loss, or a ransomware incident. The severity depends on the type and amount of data stored on the affected volumes. Organizations in regulated industries may face compliance violations if sensitive data is stored without encryption. This could potentially impact hundreds or thousands of EBS volumes depending on the period the encryption was disabled.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eDeploy the Sigma rule provided in this brief to detect instances of \u003ccode\u003eDisableEbsEncryptionByDefault\u003c/code\u003e in your AWS environment, leveraging CloudTrail logs.\u003c/li\u003e\n\u003cli\u003eReview IAM policies to restrict the \u003ccode\u003eec2:DisableEbsEncryptionByDefault\u003c/code\u003e permission to only authorized administrators.\u003c/li\u003e\n\u003cli\u003eEnable AWS Config rules and Security Hub controls related to EBS encryption (\u003ccode\u003eec2-ebs-encryption-by-default-enabled\u003c/code\u003e) to continuously monitor this setting, per the overview.\u003c/li\u003e\n\u003cli\u003eAfter detection, use the investigation steps in the original Elastic rule to identify affected resources and remediate the misconfiguration.\u003c/li\u003e\n\u003cli\u003eEnable organization-level service control policies (SCPs) to prevent future disabling of encryption-by-default across accounts, as per the original rule documentation.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2024-01-09T18:25:00Z","date_published":"2024-01-09T18:25:00Z","id":"https://feed.craftedsignal.io/briefs/2024-01-09-aws-ebs-encryption-disabled/","summary":"Detects when Amazon Elastic Block Store (EBS) encryption by default is disabled in an AWS region, potentially leading to data exposure and weakening data protection against exfiltration or ransomware.","title":"AWS EBS Encryption Disabled","url":"https://feed.craftedsignal.io/briefs/2024-01-09-aws-ebs-encryption-disabled/"}],"language":"en","title":"CraftedSignal Threat Feed - Elastic Block Store (EBS)","version":"https://jsonfeed.org/version/1.1"}