Sunturai
Back to results
HighSigmaHQtoopricey

AWS KMS Imported Key Material Usage

Detects the import or deletion of key material in AWS KMS, which can be used as part of ransomware attacks. This activity is uncommon and provides a high certainty signal.

Detection logic

Detection requirements

Platform
ESXiIaaSLinuxmacOSPREWindows

The rule states no platform. This is derived from the 2 ATT&CK techniques it maps to.

Log source product
aws
Log source service
cloudtrail

Known benign triggers

  • Development or testing environments that simulate external key management scenarios. Even in these cases, such activity is typically infrequent and should not add significant noise.
  • Legitimate use cases for imported key material are rare, but may include, Organizations with hybrid cloud architectures that import external key material for compliance requirements.

Detections can measure how the public catalogue is used — which detections people look for, and which pages bring them here. It sets a cookie that recognises this browser for 180 days. It is never linked to an account and never follows you to other sites. Privacy notice