Emulating AWS S3 SSE-C Ransom for Threat Detection

The report explains how adversaries can leverage AWS S3’s SSE-C (customer-provided keys) to encrypt objects for ransom/extortion, then pressure victims via lifecycle policies, and it provides a whitebox emulation using Terraform and Python to reproduce the behavior. It outlines the required IAM permissions, the role of pre-signed URLs and SigV4 signing, and offers CloudTrail-based detection logic and hunting guidance (e.g., spotting PutObject with SSE-C headers and using Elastic’s New Terms rules) to identify anomalous SSE-C usage in S3.