Sigma high experimental sigma

AWS KMS Imported Key Material Usage

Detects the import or deletion of key material in AWS KMS, which can be used as part of ransomware attacks. This activity is uncommon and provides a high certainty signal.

View Source

Detection Logic

{
  "selection": {
    "eventSource": "kms.amazonaws.com",
    "eventName": [
      "ImportKeyMaterial",
      "DeleteImportedKeyMaterial"
    ]
  },
  "condition": "selection"
}

False Positives

⚠ Legitimate use cases for imported key material are rare, but may include, Organizations with hybrid cloud architectures that import external key material for compliance requirements.
⚠ Development or testing environments that simulate external key management scenarios. Even in these cases, such activity is typically infrequent and should not add significant noise.

Field Validations

Loading…

Comments (0)

Loading comments...