Title:
AWS EC2 Disable EBS Encryption
Status:
stable
Description:Identifies disabling of default Amazon Elastic Block Store (EBS) encryption in the current region.
Disabling default encryption does not change the encryption status of your existing volumes.
References:
-https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DisableEbsEncryptionByDefault.html
Author: Sittikorn S
Date: 2021-06-29
modified:2021-08-20
Tags:
- -'attack.impact'
- -'attack.t1486'
- -'attack.t1565'
Logsource:
- product: aws
- service: cloudtrail
Detection:
selection:
eventSource:
'ec2.amazonaws.com'
eventName:
'DisableEbsEncryptionByDefault'
condition:
selection
Falsepositives:
-System Administrator Activities
-DEV, UAT, SAT environment. You should apply this rule with PROD account only.
Level:
medium
