Utimaco ESKM - PERMISSION_DENIED burst for a KMIP user

Identifies a single KMIP user receiving 10 or more PERMISSION_DENIED responses within 30 minutes on Utimaco ESKM. May indicate privilege probing, key access reconnaissance, or a misconfigured application.

Detection logic

Detection requirements

Platform: ESXi IaaS Identity Provider Linux macOS Office Suite SaaS Windows
The rule states no platform. This is derived from the ATT&CK technique it maps to.
Log source product: utimacoeskmconnector
Log source service: utimacoeskmkmipserverlogs_cl

Detection rules

Utimaco ESKM - PERMISSION_DENIED burst for a KMIP user

Detection logic

Detection requirements

MITRE ATT&CK mappings

From the source

Licence

Authorship

Detection rules