Sunturai
Back to results
MediumElastic detection rulesElastic

AWS S3 Object Encryption Using External KMS Key

Identifies use of the S3 CopyObject API where the destination object is encrypted using an AWS KMS key from an external AWS account. This behavior may indicate ransomware-style impact activity where an adversary with…

Description

Identifies use of the S3 CopyObject API where the destination object is encrypted using an AWS KMS key from an external AWS account. This behavior may indicate ransomware-style impact activity where an adversary with access to a misconfigured S3 bucket encrypts objects using a KMS key they control, preventing the bucket owner from decrypting their own data. This technique is a critical early signal of destructive intent or cross-account misuse.

Detection logic

Its licence does not clear it for publishing here

Sunturai publishes a detection's own text where the licence it arrived under has been reviewed and permits it, and Elastic License 2.0 has not. The query as its source wrote it, its canonical form and the hash that pins this revision are in the workspace record.

Sign in to read itCreate an account

Detection requirements

Platform
ESXiIaaSLinuxmacOSWindows

The rule states no platform. This is derived from the ATT&CK technique it maps to.

Known benign triggers

  • Cross-account KMS key usage may be legitimate in multi-account AWS Organizations architectures where centralized encryption keys are used for data governance or auditing workflows. Confirm whether the external KMS key belongs to an expected account before taking action. Data migration or cross-account backup workflows may legitimately re-encrypt S3 objects using a key in another account. Ensure these workflows are documented, tied to known IAM roles, and occur on predictable schedules.

Detections can measure how the public catalogue is used — which detections people look for, and which pages bring them here. It sets a cookie that recognises this browser for 180 days. It is never linked to an account and never follows you to other sites. Privacy notice