Analytics High
✕

Suspicious objects encryption in an AWS bucket

An AWS KMS key from a non-organization account was used to encrypt multiple objects in a bucket for the first time. This may indicate an attacker attempting to perform a ransomware attack against the organization's cloud environment.

Module:
Cortex Cloud
Licensed by:
Cloud Runtime Security (CRS)
Data source:
AWS Audit Log
ATT&CK tactics: Impact (TA0040)
ATT&CK techniques: Data Encrypted for Impact (T1486)
Detector tags: Cloud Data Asset Protection Tampering Data Detection & Response
Attacker's goals:

Gain monetary compensation in exchange for decryption or the decryption key. Permanently deny access to important storage objects.

Investigative actions:

Check if the external KMS service is a legit encryption service. Check if the identity performed enumeration activity to detect insecure S3 buckets, which are configured without the versioning and MFA Delete mechanisms. Detect additional buckets that were encrypted using the same external KMS service. Disable the identity from which the external service was configured. Enable versioning on every critical bucket. Enable MFA Delete on every critical bucket.

Test period:
1 Hour
Deduplication:
1 Day