Tag
Unusual AWS S3 Object Encryption with SSE-C
1 rule 2 TTPsAdversaries with compromised AWS credentials can exploit Server-Side Encryption with Customer-Provided Keys (SSE-C) in Amazon S3 to encrypt objects, rendering them unreadable and potentially enabling ransomware operations, which detection engineers can identify by monitoring CloudTrail logs for specific `PutObject` or `CopyObject` API calls.
The Gentlemen Ransomware: Self-Propagating Go Encryptor
2 rules 4 TTPsThe Gentlemen ransomware, operated by Storm-2697 as a RaaS, employs a combination of strong per-file encryption with aggressive self-propagation to achieve broad network compromise, targeting Windows environments and using double extortion tactics.
WinRAR and 7-Zip Encryption Abuse for Data Exfiltration Preparation
3 rules 2 TTPsAdversaries use WinRAR or 7-Zip to create encrypted archives in preparation for data exfiltration, using command-line arguments to enable encryption functionality.
AWS KMS Key User Performing S3 Encryption
2 rules 1 TTPDetection of AWS users employing KMS keys for S3 encryption, potentially indicating suspicious data handling within cloud environments.
AWS EBS Encryption Disabled
2 rules 2 TTPsDetects when Amazon Elastic Block Store (EBS) encryption by default is disabled in an AWS region, potentially leading to data exposure and weakening data protection against exfiltration or ransomware.
AWS KMS Key User Performing S3 Encryption Detection
2 rules 1 TTPDetection of AWS users utilizing KMS keys to perform encryption operations on S3 buckets, indicating potential misuse or malicious activity within the cloud environment.
PowerShell Script with Encryption/Decryption Capabilities
2 rules 3 TTPsPowerShell scripts employing .NET cryptography APIs are used to encrypt data for impact or decrypt payloads for defense evasion.
ESXi Encryption Settings Modified
2 rules 2 TTPsAttackers modify ESXi host encryption settings, such as disabling secure boot or executable verification, to weaken hypervisor integrity and enable unauthorized code execution.
ESXi Encryption Settings Modification
2 rulesDetection of modifications to ESXi host encryption settings, such as disabling secure boot or executable verification, which may indicate attempts to weaken hypervisor integrity and allow unauthorized code execution.
AWS User Performing S3 Encryption with KMS Keys
2 rules 1 TTPA user with KMS keys is performing encryption operations on S3 buckets, potentially masking exfiltration or tampering efforts by encrypting sensitive data to evade detection or preparing it for exfiltration.
AWS KMS Key Creation with Public Encryption Policy
2 rules 1 TTPAn attacker may create AWS KMS keys with a permissive encryption policy, granting `kms:Encrypt` permissions to all principals, potentially leading to unauthorized encryption and data compromise across multiple organizations.
AWS IAM Key Creation with Encryption Policy but Without MFA
2 rules 2 TTPsDetection of AWS IAM users creating access keys with encryption policies applied while failing to use multi-factor authentication, potentially indicating compromised accounts or malicious privilege escalation.