Suspicious objects encryption in an AWS bucket

Synopsis

Field	Value
Activation Period	14 Days
Training Period	30 Days
Test Period	1 Hour
Deduplication Period	1 Day
Required Data	AWS Audit Log
Detection Modules	Cloud
Detector Tags	Cloud Data Asset Protection Tampering, Data Detection & Response
ATT&CK Tactic	Impact (TA0040)
ATT&CK Technique	Data Encrypted for Impact (T1486)
Severity	High

Description

An AWS KMS key from a non-organization account was used to encrypt multiple objects in a bucket for the first time. This may indicate an attacker attempting to perform a ransomware attack against the organization's cloud environment.

Attacker's Goals

• Gain monetary compensation in exchange for decryption or the decryption key.
• Permanently deny access to important storage objects.

Investigative actions

• Check if the external KMS service is a legit encryption service.
• Check if the identity performed enumeration activity to detect insecure S3 buckets, which are configured without the versioning and MFA Delete mechanisms.
• Detect additional buckets that were encrypted using the same external KMS service.
• Disable the identity from which the external service was configured.
• Enable versioning on every critical bucket.
• Enable MFA Delete on every critical bucket.