deardaniel/secdata-raw huggingface dataset:
Sigma Detection Rule: AWS EnableRegion Command Monitoring
Repository: SigmaHQ/sigma
Severity: medium
Status: experimental
Author: Ivan Saakov, Sergey Zelenskiy
Date: 2025-10-19
Log source: aws/

Description:
Detects the use of the EnableRegion command in AWS CloudTrail logs.
While AWS has 30+ regions, some of them are enabled by default, others must be explicitly enabled in each account separately.
There may be situations where security monitoring does not cover some new AWS regions.
Monitoring the EnableRegion command is important for identifying potential persistence mechanisms employed by adversaries, as enabling additional regions can facilitate continued access and operations within an AWS environment.


Detection logic:
{
  "selection": {
    "eventName": "EnableRegion",
    "eventSource": "account.amazonaws.com"
  },
  "condition": "selection"
}

References:
  - https://docs.aws.amazon.com/accounts/latest/reference/API_EnableRegion.html
  - https://awscli.amazonaws.com/v2/documentation/api/2.14.0/reference/account/enable-region.html
Sigma Detection Rule: AWS Key Pair Import Activity
Repository: SigmaHQ/sigma
Severity: medium
Status: experimental
Author: Ivan Saakov
Date: 2024-12-19
ATT&CK techniques: T1078
Log source: aws/

Description:
Detects the import of SSH key pairs into AWS EC2, which may indicate an attacker attempting to gain unauthorized access to instances. This activity could lead to initial access, persistence, or privilege escalation, potentially compromising sensitive data and operations.


Detection logic:
{
  "selection": {
    "eventSource": "ec2.amazonaws.com",
    "eventName": "ImportKeyPair"
  },
  "condition": "selection"
}

References:
  - https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ImportKeyPair.html
Sigma Detection Rule: Ingress/Egress Security Group Modification
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: jamesc-grafana
Date: 2024-07-11
ATT&CK techniques: T1190
Log source: aws/

Description:
Detects when an account makes changes to the ingress or egress rules of a security group.
This can indicate that an attacker is attempting to open up new attack vectors in the account, that they are trying to exfiltrate data over the network, or that they are trying to allow machines in that VPC/Subnet to contact a C&C server.


Detection logic:
{
  "selection": {
    "eventSource": "ec2.amazonaws.com",
    "eventName": [
      "AuthorizeSecurityGroupEgress",
      "AuthorizeSecurityGroupIngress",
      "RevokeSecurityGroupEgress",
      "RevokeSecurityGroupIngress"
    ]
  },
  "condition": "selection"
}

References:
  - https://www.gorillastack.com/blog/real-time-events/important-aws-cloudtrail-security-events-tracking/
Sigma Detection Rule: AWS Identity Center Identity Provider Change
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Michael McIntyre @wtfender
Date: 2023-09-27
ATT&CK techniques: T1556
Log source: aws/

Description:
Detects a change in the AWS Identity Center (FKA AWS SSO) identity provider.
A change in identity provider allows an attacker to establish persistent access or escalate privileges via user impersonation.


Detection logic:
{
  "selection": {
    "eventSource": [
      "sso-directory.amazonaws.com",
      "sso.amazonaws.com"
    ],
    "eventName": [
      "AssociateDirectory",
      "DisableExternalIdPConfigurationForDirectory",
      "DisassociateDirectory",
      "EnableExternalIdPConfigurationForDirectory"
    ]
  },
  "condition": "selection"
}

References:
  - https://docs.aws.amazon.com/singlesignon/latest/userguide/app-enablement.html
  - https://docs.aws.amazon.com/singlesignon/latest/userguide/sso-info-in-cloudtrail.html
  - https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsiamidentitycentersuccessortoawssinglesign-on.html
Sigma Detection Rule: AWS Suspicious SAML Activity
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Austin Songer
Date: 2021-09-22
ATT&CK techniques: T1078, T1548, T1550, T1550.001
Log source: aws/

Description:
Identifies when suspicious SAML activity has occurred in AWS. An adversary could gain backdoor access via SAML.

Detection logic:
{
  "selection_sts": {
    "eventSource": "sts.amazonaws.com",
    "eventName": "AssumeRoleWithSAML"
  },
  "selection_iam": {
    "eventSource": "iam.amazonaws.com",
    "eventName": "UpdateSAMLProvider"
  },
  "condition": "1 of selection_*"
}

References:
  - https://docs.aws.amazon.com/IAM/latest/APIReference/API_UpdateSAMLProvider.html
  - https://docs.aws.amazon.com/STS/latest/APIReference/API_AssumeRoleWithSAML.html
Sigma Detection Rule: LoadBalancer Security Group Modification
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: jamesc-grafana
Date: 2024-07-11
ATT&CK techniques: T1190
Log source: aws/

Description:
Detects changes to the security groups associated with an Elastic Load Balancer (ELB) or Application Load Balancer (ALB).
This can indicate that a misconfiguration allowing more traffic into the system than required, or could indicate that an attacker is attempting to enable new connections into a VPC or subnet controlled by the account.


Detection logic:
{
  "selection": {
    "eventSource": "elasticloadbalancing.amazonaws.com",
    "eventName": [
      "ApplySecurityGroupsToLoadBalancer",
      "SetSecurityGroups"
    ]
  },
  "condition": "selection"
}

References:
  - https://www.gorillastack.com/blog/real-time-events/important-aws-cloudtrail-security-events-tracking/
Sigma Detection Rule: AWS GuardDuty Important Change
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: faloker
Date: 2020-02-11
ATT&CK techniques: T1685
Log source: aws/

Description:
Detects updates of the GuardDuty list of trusted IPs, perhaps to disable security alerts against malicious IPs.

Detection logic:
{
  "selection_source": {
    "eventSource": "guardduty.amazonaws.com",
    "eventName": "CreateIPSet"
  },
  "condition": "selection_source"
}

References:
  - https://github.com/RhinoSecurityLabs/pacu/blob/866376cd711666c775bbfcde0524c817f2c5b181/pacu/modules/guardduty__whitelist_ip/main.py#L9
Sigma Detection Rule: AWS Config Disabling Channel/Recorder
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: vitaliy0x1
Date: 2020-01-21
ATT&CK techniques: T1685.002
Log source: aws/

Description:
Detects AWS Config Service disabling

Detection logic:
{
  "selection": {
    "eventSource": "config.amazonaws.com",
    "eventName": [
      "DeleteDeliveryChannel",
      "StopConfigurationRecorder"
    ]
  },
  "condition": "selection"
}

References:
  - https://docs.aws.amazon.com/config/latest/developerguide/cloudtrail-log-files-for-aws-config.html
Sigma Detection Rule: AWS Glue Development Endpoint Activity
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: Austin Songer @austinsonger
Date: 2021-10-03
Log source: aws/

Description:
Detects possible suspicious glue development endpoint activity.

Detection logic:
{
  "selection": {
    "eventSource": "glue.amazonaws.com",
    "eventName": [
      "CreateDevEndpoint",
      "DeleteDevEndpoint",
      "UpdateDevEndpoint"
    ]
  },
  "condition": "selection"
}

References:
  - https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation/
  - https://docs.aws.amazon.com/glue/latest/webapi/API_CreateDevEndpoint.html
Sigma Detection Rule: SES Identity Has Been Deleted
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Janantha Marasinghe
Date: 2022-12-13
ATT&CK techniques: T1070
Log source: aws/

Description:
Detects an instance of an SES identity being deleted via the "DeleteIdentity" event. This may be an indicator of an adversary removing the account that carried out suspicious or malicious activities

Detection logic:
{
  "selection": {
    "eventSource": "ses.amazonaws.com",
    "eventName": "DeleteIdentity"
  },
  "condition": "selection"
}

References:
  - https://unit42.paloaltonetworks.com/compromised-cloud-compute-credentials/
Sigma Detection Rule: AWS EFS Fileshare Modified or Deleted
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Austin Songer @austinsonger
Date: 2021-08-15
Log source: aws/

Description:
Detects when a EFS Fileshare is modified or deleted.
You can't delete a file system that is in use.
If the file system has any mount targets, the adversary must first delete them, so deletion of a mount will occur before deletion of a fileshare.


Detection logic:
{
  "selection": {
    "eventSource": "elasticfilesystem.amazonaws.com",
    "eventName": "DeleteFileSystem"
  },
  "condition": "selection"
}

References:
  - https://docs.aws.amazon.com/efs/latest/ug/API_DeleteFileSystem.html
Sigma Detection Rule: Modification or Deletion of an AWS RDS Cluster
Repository: SigmaHQ/sigma
Severity: high
Status: experimental
Author: Ivan Saakov
Date: 2024-12-06
ATT&CK techniques: T1020
Log source: aws/

Description:
Detects modifications to an RDS cluster or its deletion, which may indicate potential data exfiltration attempts, unauthorized access, or exposure of sensitive information.

Detection logic:
{
  "selection": {
    "eventSource": "rds.amazonaws.com",
    "eventName": [
      "ModifyDBCluster",
      "DeleteDBCluster"
    ]
  },
  "condition": "selection"
}

References:
  - https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_ModifyDBCluster.html
  - https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_DeleteDBCluster.html
  - https://cloud.hacktricks.xyz/pentesting-cloud/aws-security/aws-privilege-escalation/aws-rds-privesc#rds-modifydbinstance
Sigma Detection Rule: New Network Route Added
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: jamesc-grafana
Date: 2024-07-11
ATT&CK techniques: T1686.001
Log source: aws/

Description:
Detects the addition of a new network route to a route table in AWS.


Detection logic:
{
  "selection": {
    "eventSource": "ec2.amazonaws.com",
    "eventName": "CreateRoute"
  },
  "condition": "selection"
}

References:
  - https://www.gorillastack.com/blog/real-time-events/important-aws-cloudtrail-security-events-tracking/
Sigma Detection Rule: AWS STS GetCallerIdentity Enumeration Via TruffleHog
Repository: SigmaHQ/sigma
Severity: medium
Status: experimental
Author: Adan Alvarez @adanalvarez
Date: 2025-10-12
ATT&CK techniques: T1087.004
Log source: aws/

Description:
Detects the use of TruffleHog for AWS credential validation by identifying GetCallerIdentity API calls where the userAgent indicates TruffleHog.
Threat actors leverage TruffleHog to enumerate and validate exposed AWS keys.
Successful exploitation allows threat actors to confirm the validity of compromised AWS credentials, facilitating further unauthorized access and actions within the AWS environment.


Detection logic:
{
  "selection": {
    "eventSource": "sts.amazonaws.com",
    "eventName": "GetCallerIdentity",
    "userAgent|contains": "TruffleHog"
  },
  "condition": "selection"
}

References:
  - https://www.rapid7.com/blog/post/tr-crimson-collective-a-new-threat-group-observed-operating-in-the-cloud/
  - https://docs.aws.amazon.com/STS/latest/APIReference/API_GetCallerIdentity.html
  - https://github.com/trufflesecurity/trufflehog
Sigma Detection Rule: AWS SecurityHub Findings Evasion
Repository: SigmaHQ/sigma
Severity: high
Status: stable
Author: Sittikorn S
Date: 2021-06-28
ATT&CK techniques: T1685
Log source: aws/

Description:
Detects the modification of the findings on SecurityHub.

Detection logic:
{
  "selection": {
    "eventSource": "securityhub.amazonaws.com",
    "eventName": [
      "BatchUpdateFindings",
      "DeleteInsight",
      "UpdateFindings",
      "UpdateInsight"
    ]
  },
  "condition": "selection"
}

References:
  - https://docs.aws.amazon.com/cli/latest/reference/securityhub/
Sigma Detection Rule: RDS Database Security Group Modification
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: jamesc-grafana
Date: 2024-07-11
ATT&CK techniques: T1190
Log source: aws/

Description:
Detects changes to the security group entries for RDS databases.
This can indicate that a misconfiguration has occurred which potentially exposes the database to the public internet, a wider audience within the VPC or that removal of valid rules has occurred which could impact the availability of the database to legitimate services and users.


Detection logic:
{
  "selection": {
    "eventSource": "rds.amazonaws.com",
    "eventName": [
      "AuthorizeDBSecurityGroupIngress",
      "CreateDBSecurityGroup",
      "DeleteDBSecurityGroup",
      "RevokeDBSecurityGroupIngress"
    ]
  },
  "condition": "selection"
}

References:
  - https://www.gorillastack.com/blog/real-time-events/important-aws-cloudtrail-security-events-tracking/
Sigma Detection Rule: AWS EFS Fileshare Mount Modified or Deleted
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Austin Songer @austinsonger
Date: 2021-08-15
ATT&CK techniques: T1485
Log source: aws/

Description:
Detects when a EFS Fileshare Mount is modified or deleted. An adversary breaking any file system using the mount target that is being deleted, which might disrupt instances or applications using those mounts.

Detection logic:
{
  "selection": {
    "eventSource": "elasticfilesystem.amazonaws.com",
    "eventName": "DeleteMountTarget"
  },
  "condition": "selection"
}

References:
  - https://docs.aws.amazon.com/efs/latest/ug/API_DeleteMountTarget.html
Sigma Detection Rule: AWS S3 Bucket Versioning Disable
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Sean Johnstone | Unit 42
Date: 2023-10-28
ATT&CK techniques: T1490
Log source: aws/

Description:
Detects when S3 bucket versioning is disabled. Threat actors use this technique during AWS ransomware incidents prior to deleting S3 objects.

Detection logic:
{
  "selection": {
    "eventSource": "s3.amazonaws.com",
    "eventName": "PutBucketVersioning",
    "requestParameters|contains": "Suspended"
  },
  "condition": "selection"
}

References:
  - https://invictus-ir.medium.com/ransomware-in-the-cloud-7f14805bbe82
Sigma Detection Rule: AWS Snapshot Backup Exfiltration
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Darin Smith
Date: 2021-05-17
ATT&CK techniques: T1537
Log source: aws/

Description:
Detects the modification of an EC2 snapshot's permissions to enable access from another account

Detection logic:
{
  "selection_source": {
    "eventSource": "ec2.amazonaws.com",
    "eventName": "ModifySnapshotAttribute"
  },
  "condition": "selection_source"
}

References:
  - https://www.justice.gov/file/1080281/download
Sigma Detection Rule: AWS S3 Data Management Tampering
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: Austin Songer @austinsonger
Date: 2021-07-24
ATT&CK techniques: T1537
Log source: aws/

Description:
Detects when a user tampers with S3 data management in Amazon Web Services.

Detection logic:
{
  "selection": {
    "eventSource": "s3.amazonaws.com",
    "eventName": [
      "PutBucketLogging",
      "PutBucketWebsite",
      "PutEncryptionConfiguration",
      "PutLifecycleConfiguration",
      "PutReplicationConfiguration",
      "ReplicateObject",
      "RestoreObject"
    ]
  },
  "condition": "selection"
}

References:
  - https://github.com/elastic/detection-rules/pull/1145/files
  - https://docs.aws.amazon.com/AmazonS3/latest/API/API_Operations.html
  - https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutBucketLogging.html
  - https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutBucketWebsite.html
  - https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutBucketEncryption.html
Sigma Detection Rule: AWS User Login Profile Was Modified
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: toffeebr33k
Date: 2021-08-09
ATT&CK techniques: T1098
Log source: aws/

Description:
Detects activity when someone is changing passwords on behalf of other users.
An attacker with the "iam:UpdateLoginProfile" permission on other users can change the password used to login to the AWS console on any user that already has a login profile setup.


Detection logic:
{
  "selection": {
    "eventSource": "iam.amazonaws.com",
    "eventName": "UpdateLoginProfile"
  },
  "filter_main_user_identity": {
    "userIdentity.arn|fieldref": "requestParameters.userName"
  },
  "condition": "selection and not 1 of filter_main_*"
}

References:
  - https://github.com/RhinoSecurityLabs/AWS-IAM-Privilege-Escalation
Sigma Detection Rule: AWS EC2 VM Export Failure
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: Diogo Braz
Date: 2020-04-16
ATT&CK techniques: T1005, T1537
Log source: aws/

Description:
An attempt to export an AWS EC2 instance has been detected. A VM Export might indicate an attempt to extract information from an instance.

Detection logic:
{
  "selection": {
    "eventName": "CreateInstanceExportTask",
    "eventSource": "ec2.amazonaws.com"
  },
  "filter1": {
    "errorMessage|contains": "*"
  },
  "filter2": {
    "errorCode|contains": "*"
  },
  "filter3": {
    "responseElements|contains": "Failure"
  },
  "condition": "selection and not 1 of filter*"
}

References:
  - https://docs.aws.amazon.com/vm-import/latest/userguide/vmexport.html#export-instance
Sigma Detection Rule: AWS IAM S3Browser LoginProfile Creation
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: daniel.bohannon@permiso.io (@danielhbohannon)
Date: 2023-05-17
ATT&CK techniques: T1059.009, T1078.004
Log source: aws/

Description:
Detects S3 Browser utility performing reconnaissance looking for existing IAM Users without a LoginProfile defined then (when found) creating a LoginProfile.

Detection logic:
{
  "selection": {
    "eventSource": "iam.amazonaws.com",
    "eventName": [
      "GetLoginProfile",
      "CreateLoginProfile"
    ],
    "userAgent|contains": "S3 Browser"
  },
  "condition": "selection"
}

References:
  - https://permiso.io/blog/s/unmasking-guivil-new-cloud-threat-actor
Sigma Detection Rule: AWS Bucket Deleted
Repository: SigmaHQ/sigma
Severity: medium
Status: experimental
Author: Ivan Saakov, Nasreddine Bencherchali
Date: 2025-10-19
Log source: aws/

Description:
Detects the deletion of S3 buckets in AWS CloudTrail logs.
Monitoring the deletion of S3 buckets is critical for security and data integrity, as it may indicate potential data loss or unauthorized access attempts.


Detection logic:
{
  "selection_event_name": {
    "eventName": "DeleteBucket"
  },
  "selection_status_success": {
    "errorCode": "Success"
  },
  "selection_status_null": {
    "errorCode": null
  },
  "condition": "selection_event_name and 1 of selection_status_*"
}

References:
  - https://docs.aws.amazon.com/AmazonS3/latest/API/API_DeleteBucket.html
  - https://awscli.amazonaws.com/v2/documentation/api/latest/reference/s3api/delete-bucket.html
Sigma Detection Rule: AWS ConsoleLogin Failed Authentication
Repository: SigmaHQ/sigma
Severity: medium
Status: experimental
Author: Ivan Saakov, Nasreddine Bencherchali
Date: 2025-10-19
ATT&CK techniques: T1110
Log source: aws/

Description:
Detects failed AWS console login attempts due to authentication failures. Monitoring these events is crucial for identifying potential brute-force attacks or unauthorized access attempts to AWS accounts.


Detection logic:
{
  "selection": {
    "eventName": "ConsoleLogin",
    "errorMessage": "Failed authentication"
  },
  "condition": "selection"
}

References:
  - https://naikordian.github.io/blog/posts/brute-force-aws-console/
  - https://help.fortinet.com/fsiem/Public_Resource_Access/7_2_1/rules/PH_RULE_AWS_Management_Console_Brute_Force_of_Root_User_Identity.htm
  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.001/aws_login_failure/aws_cloudtrail_events.json
Sigma Detection Rule: PUA - AWS TruffleHog Execution
Repository: SigmaHQ/sigma
Severity: medium
Status: experimental
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
Date: 2025-10-21
ATT&CK techniques: T1555, T1003
Log source: aws/

Description:
Detects the execution of TruffleHog, a popular open-source tool used for scanning repositories for secrets and sensitive information, within an AWS environment.
It has been reported to be used by threat actors for credential harvesting. All detections should be investigated to determine if the usage is authorized by security teams or potentially malicious.


Detection logic:
{
  "selection": {
    "userAgent": "TruffleHog"
  },
  "condition": "selection"
}

References:
  - https://github.com/trufflesecurity/trufflehog
  - https://www.rapid7.com/blog/post/tr-crimson-collective-a-new-threat-group-observed-operating-in-the-cloud/
Sigma Detection Rule: Potential Malicious Usage of CloudTrail System Manager
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: jamesc-grafana
Date: 2024-07-11
ATT&CK techniques: T1566, T1566.002
Log source: aws/

Description:
Detect when System Manager successfully executes commands against an instance.


Detection logic:
{
  "selection_event": {
    "eventName": "SendCommand",
    "eventSource": "ssm.amazonaws.com"
  },
  "selection_status_success": {
    "errorCode": "Success"
  },
  "selection_status_null": {
    "errorCode": null
  },
  "condition": "selection_event and 1 of selection_status_*"
}

References:
  - https://github.com/elastic/detection-rules/blob/v8.6.0/rules/integrations/aws/initial_access_via_system_manager.toml
Sigma Detection Rule: AWS Route 53 Domain Transfer Lock Disabled
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: Elastic, Austin Songer @austinsonger
Date: 2021-07-22
ATT&CK techniques: T1098
Log source: aws/

Description:
Detects when a transfer lock was removed from a Route 53 domain. It is recommended to refrain from performing this action unless intending to transfer the domain to a different registrar.

Detection logic:
{
  "selection": {
    "eventSource": "route53.amazonaws.com",
    "eventName": "DisableDomainTransferLock"
  },
  "condition": "selection"
}

References:
  - https://github.com/elastic/detection-rules/blob/c76a39796972ecde44cb1da6df47f1b6562c9770/rules/integrations/aws/persistence_route_53_domain_transfer_lock_disabled.toml
  - https://docs.aws.amazon.com/Route53/latest/APIReference/API_Operations_Amazon_Route_53.html
  - https://docs.aws.amazon.com/Route53/latest/APIReference/API_domains_DisableDomainTransferLock.html
Sigma Detection Rule: AWS ECS Task Definition That Queries The Credential Endpoint
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Darin Smith
Date: 2022-06-07
ATT&CK techniques: T1525
Log source: aws/

Description:
Detects when an Elastic Container Service (ECS) Task Definition includes a command to query the credential endpoint.
This can indicate a potential adversary adding a backdoor to establish persistence or escalate privileges.


Detection logic:
{
  "selection": {
    "eventSource": "ecs.amazonaws.com",
    "eventName": [
      "DescribeTaskDefinition",
      "RegisterTaskDefinition",
      "RunTask"
    ],
    "requestParameters.containerDefinitions.command|contains": "$AWS_CONTAINER_CREDENTIALS_RELATIVE_URI"
  },
  "condition": "selection"
}

References:
  - https://github.com/RhinoSecurityLabs/pacu/blob/866376cd711666c775bbfcde0524c817f2c5b181/pacu/modules/ecs__backdoor_task_def/main.py
  - https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_RegisterTaskDefinition.html
  - https://docs.aws.amazon.com/AmazonECS/latest/developerguide/task-iam-roles.html
Sigma Detection Rule: AWS EC2 Disable EBS Encryption
Repository: SigmaHQ/sigma
Severity: medium
Status: stable
Author: Sittikorn S
Date: 2021-06-29
ATT&CK techniques: T1486, T1565
Log source: aws/

Description:
Identifies disabling of default Amazon Elastic Block Store (EBS) encryption in the current region.
Disabling default encryption does not change the encryption status of your existing volumes.


Detection logic:
{
  "selection": {
    "eventSource": "ec2.amazonaws.com",
    "eventName": "DisableEbsEncryptionByDefault"
  },
  "condition": "selection"
}

References:
  - https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DisableEbsEncryptionByDefault.html