sigmahighHunting

AWS KMS Imported Key Material Usage

Detects the import or deletion of key material in AWS KMS, which can be used as part of ransomware attacks. This activity is uncommon and provides a high certainty signal.

MITRE ATT&CK

T1486 T1608.003

impactresource-development

Detection Query

selection:
  eventSource: kms.amazonaws.com
  eventName:
    - ImportKeyMaterial
    - DeleteImportedKeyMaterial
condition: selection

Author

toopricey

Created

2025-10-18

Data Sources

awscloudtrail

Platforms

aws

References

Tags

attack.impactattack.t1486attack.resource-developmentattack.t1608.003

Raw Content

title: AWS KMS Imported Key Material Usage
id: 1279262f-1464-422f-ac0d-5b545320c526
status: experimental
description: |
    Detects the import or deletion of key material in AWS KMS, which can be used as part of ransomware attacks. This activity is uncommon and provides a high certainty signal.
references:
    - https://www.chrisfarris.com/post/effective-aws-ransomware/
    - https://docs.aws.amazon.com/kms/latest/developerguide/ct-importkeymaterial.html
    - https://docs.aws.amazon.com/kms/latest/developerguide/ct-deleteimportedkeymaterial.html
author: toopricey
date: 2025-10-18
tags:
    - attack.impact
    - attack.t1486
    - attack.resource-development
    - attack.t1608.003
logsource:
    product: aws
    service: cloudtrail
detection:
    selection:
        eventSource: 'kms.amazonaws.com'
        eventName:
            - 'ImportKeyMaterial'
            - 'DeleteImportedKeyMaterial'
    condition: selection
falsepositives:
    - Legitimate use cases for imported key material are rare, but may include, Organizations with hybrid cloud architectures that import external key material for compliance requirements.
    - Development or testing environments that simulate external key management scenarios. Even in these cases, such activity is typically infrequent and should not add significant noise.
level: high