https://feed.craftedsignal.io/tags/ebs/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioTue, 09 Jan 2024 18:25:00 +0000https://feed.craftedsignal.io/briefs/2024-01-09-aws-ebs-encryption-disabled/Tue, 09 Jan 2024 18:25:00 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2024-01-09-aws-ebs-encryption-disabled/Detects when Amazon Elastic Block Store (EBS) encryption by default is disabled in an AWS region, potentially leading to data exposure and weakening data protection against exfiltration or ransomware.This detection identifies instances where Amazon Elastic Block Store (EBS) encryption by default is disabled within an AWS region. The default encryption ensures that all new EBS volumes and snapshots are automatically encrypted, protecting data at rest. Disabling this setting, detected via CloudTrail logs, introduces a significant security risk. Attackers may disable encryption to weaken data protection measures before initiating data exfiltration or tampering with EBS volumes and snapshots. This action can serve as a precursor to data theft or ransomware attacks, as unencrypted volumes are easier to compromise. The rule focuses on the DisableEbsEncryptionByDefault event logged by CloudTrail when this configuration change occurs. Elastic has released this rule as part of their detection ruleset on 2026-04-10.

Attack Chain

1. An attacker gains access to an AWS account, potentially through compromised credentials or a misconfigured IAM role.
2. The attacker uses the AWS CLI or API to execute the DisableEbsEncryptionByDefault command, targeting a specific AWS region.
3. CloudTrail logs the DisableEbsEncryptionByDefault event, indicating that default EBS encryption has been disabled.
4. The attacker creates new EBS volumes within the affected region, which are now unencrypted by default.
5. Sensitive data is stored on these newly created, unencrypted EBS volumes.
6. The attacker exfiltrates the data from the unencrypted EBS volumes to an external location.
7. Alternatively, the attacker might deploy ransomware on instances using the unencrypted volumes, encrypting the data and demanding a ransom.
8. The attacker covers their tracks by deleting or modifying CloudTrail logs, if possible, to hide their activity.

Impact

Disabling EBS encryption by default can lead to the creation of unencrypted EBS volumes, exposing sensitive data at rest. A successful attack could result in data theft, data loss, or a ransomware incident. The severity depends on the type and amount of data stored on the affected volumes. Organizations in regulated industries may face compliance violations if sensitive data is stored without encryption. This could potentially impact hundreds or thousands of EBS volumes depending on the period the encryption was disabled.

Recommendation

• Deploy the Sigma rule provided in this brief to detect instances of DisableEbsEncryptionByDefault in your AWS environment, leveraging CloudTrail logs.
• Review IAM policies to restrict the ec2:DisableEbsEncryptionByDefault permission to only authorized administrators.
• Enable AWS Config rules and Security Hub controls related to EBS encryption (ec2-ebs-encryption-by-default-enabled) to continuously monitor this setting, per the overview.
• After detection, use the investigation steps in the original Elastic rule to identify affected resources and remediate the misconfiguration.
• Enable organization-level service control policies (SCPs) to prevent future disabling of encryption-by-default across accounts, as per the original rule documentation.

]]>mediumadvisoryawsebsencryptioncloudtrailhttps://feed.craftedsignal.io/briefs/2024-01-aws-ebs-snapshot-access-removed/Tue, 09 Jan 2024 15:00:00 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2024-01-aws-ebs-snapshot-access-removed/Detection of AWS EC2 EBS snapshot access permissions removal can indicate malicious attempts to disrupt data recovery, evade detection, or maintain exclusive backup access, leading to increased attack impact and incident response complexity.This detection identifies the removal of access permissions from shared AWS EC2 EBS snapshots using AWS CloudTrail logs. EBS snapshots are critical for data retention and disaster recovery. Threat actors may attempt to revoke or modify snapshot permissions to prevent legitimate users or processes from accessing backups, which hinders recovery efforts following data loss or destructive actions. This tactic can also be employed to evade detection or maintain exclusive access to sensitive backups, amplifying the impact of attacks and complicating incident response. This behavior matters because successful removal of access can significantly delay or prevent data recovery, leading to prolonged downtime and potential data loss. The rule focuses on identifying ModifySnapshotAttribute events where access is being removed, specifically looking for changes to CREATE_VOLUME_PERMISSION via remove=.

Attack Chain

1. The attacker gains unauthorized access to an AWS account, possibly through compromised credentials or exploiting IAM misconfigurations.
2. The attacker enumerates available EC2 EBS snapshots within the targeted AWS environment to identify potential targets for disruption.
3. The attacker uses the ModifySnapshotAttribute API call to remove access permissions from the identified EBS snapshots, specifically targeting the CREATE_VOLUME_PERMISSION attribute.
4. The request parameters in the CloudTrail logs indicate the removal of access, observed through the presence of "attributeType=CREATE_VOLUME_PERMISSION" and "remove=".
5. Legitimate users or automated processes attempting to restore data from the affected snapshots will fail, hindering recovery efforts.
6. The attacker may repeat the process across multiple snapshots to maximize the impact and disrupt the entire recovery strategy.
7. The attacker may also delete snapshots entirely using DeleteSnapshot to ensure complete data loss.
8. The attacker achieves their objective of disrupting business operations, holding data for ransom, or covering tracks by preventing forensic analysis and recovery.

Impact

Successful removal of EBS snapshot access can have significant consequences. Organizations may face extended downtime, data loss, and reputational damage. Depending on the criticality of the affected systems, financial losses and regulatory penalties may also occur. The number of victims and sectors targeted can vary, but any organization relying on AWS for data storage and backup is potentially at risk. If the attack succeeds, the organization's ability to recover from data loss events like ransomware or accidental deletion is severely compromised, potentially leading to irreversible data loss.

Recommendation

• Deploy the Sigma rule AWS EBS Snapshot Access Removal to detect unauthorized modification of snapshot access permissions in your AWS environment. Enable AWS CloudTrail logging and ensure logs are ingested to your SIEM (Security Information and Event Management) to enable the rule.
• Review IAM policies and restrict ec2:ModifySnapshotAttribute permissions to only trusted administrative roles as mentioned in the rule's investigation steps.
• Enable AWS Config rules and Security Hub controls such as ebs-snapshot-public-restorable-check to provide continuous monitoring and compliance checks, as recommended in the rule's response section.
• Implement backup immutability using AWS Backup Vault Lock or S3 Object Lock to protect against unauthorized modifications, as mentioned in the response section.
• Investigate any alerts generated by the Sigma rule, examining aws.cloudtrail.user_identity.arn and source.ip to identify the actor and source of the access removal, as indicated in the rule's triage section.

]]>mediumadvisoryawsebssnapshotimpact