AWS KMS Key User Performing S3 Encryption Detection

hello@craftedsignal.io — Tue, 09 Jan 2024 12:00:00 +0000

This brief focuses on detecting potentially malicious or unauthorized use of AWS Key Management Service (KMS) keys to encrypt data stored in Simple Storage Service (S3) buckets. The detection logic is based on identifying AWS CloudTrail logs indicating encryption operations performed by users who possess KMS keys. While the provided source material does not specify a particular threat actor or campaign, the ability to monitor and detect such activity is crucial for identifying insider threats, compromised accounts, or misconfigured permissions that could lead to data breaches or unauthorized access. This detection capability is a part of the Splunk Enterprise Security Content Update (ESCU) project and allows security teams to quickly identify potentially suspicious activity in their AWS environments.

Attack Chain

An attacker gains unauthorized access to an AWS account, potentially through compromised credentials or misconfigured IAM roles.
The attacker identifies S3 buckets containing sensitive data.
The attacker discovers KMS keys with permissions to encrypt data in the target S3 buckets.
The attacker uses the KMS keys to encrypt existing objects in the S3 bucket or encrypts new objects as they are uploaded.
The encryption operation is logged in AWS CloudTrail.
A detection rule identifies the user utilizing KMS keys for S3 encryption based on CloudTrail logs.
Security analysts investigate the activity to determine if it is legitimate or malicious.

Impact

Successful unauthorized encryption of S3 buckets using KMS keys can lead to data unavailability, data breaches, and compliance violations. A malicious actor could encrypt data and demand ransom for decryption keys, or they could encrypt data to hide their activities or disrupt services. The number of affected buckets and the sensitivity of the data they contain will determine the scope of the impact. Failure to detect and respond to this type of activity can result in significant financial losses, reputational damage, and legal consequences.

Recommendation

Implement the Sigma rule Detect AWS KMS Key User Performing S3 Encryption to identify users with KMS keys performing encryption operations on S3 buckets based on CloudTrail logs.
Enable AWS CloudTrail logging for all regions in your AWS environment to ensure comprehensive monitoring of API activity.
Regularly review IAM policies and KMS key policies to ensure that permissions are appropriately restricted.
Investigate any alerts generated by the Sigma rule to determine the legitimacy of the encryption activity.

AWS KMS Customer Managed Key Disabled or Scheduled for Deletion

hello@craftedsignal.io — Wed, 03 Jan 2024 15:00:00 +0000

AWS KMS keys are critical for encryption across various AWS services like S3, EBS, and RDS. Disabling or scheduling a KMS key for deletion disrupts encryption and decryption workflows, potentially rendering data unrecoverable. The Elastic detection rule published on 2026-04-10 identifies attempts to disable or schedule the deletion of an AWS customer-managed KMS Key. These actions are typically rare, privileged, and tightly controlled, making unexpected instances high-risk. Adversaries might target KMS keys to sabotage recovery, impede forensic analysis, or destroy evidence. Defenders should prioritize monitoring KMS key lifecycle changes due to their potential for significant impact on data availability and business operations.

Attack Chain

An attacker gains unauthorized access to an AWS account.
The attacker escalates privileges to obtain the necessary KMS permissions.
The attacker uses the AWS CLI or API to execute the DisableKey command, specifying the ARN of the target KMS key.
Alternatively, the attacker uses the AWS CLI or API to execute the ScheduleKeyDeletion command, specifying the ARN of the target KMS key and a pending window in days.
CloudTrail logs the DisableKey or ScheduleKeyDeletion event with a status of "success".
If DisableKey was used, dependent services immediately begin failing or experience decryption errors.
If ScheduleKeyDeletion was used, the key enters a pending deletion state for the specified number of days.
Upon deletion, all data encrypted with the key becomes unrecoverable, leading to data loss and disruption of services.

Impact

Disabling or deleting KMS keys can have severe consequences, potentially impacting numerous AWS services relying on the key for encryption, including S3, EBS, RDS, Secrets Manager, and Lambda. This can lead to data unavailability, service disruptions, and irreversible data loss. The scope of impact depends on the criticality of the data protected by the key and the number of services affected. Successful execution of this attack can impede incident response efforts and result in significant financial and reputational damage.

Recommendation

Deploy the "AWS KMS Customer Managed Key Disabled or Scheduled for Deletion" Sigma rule to detect unauthorized KMS key lifecycle changes (rule.name).
Monitor AWS CloudTrail logs for DisableKey and ScheduleKeyDeletion events to detect potentially malicious activity (index).
Restrict AWS KMS lifecycle permissions (kms:DisableKey, kms:ScheduleKeyDeletion) to a minimal set of privileged users and roles (references).
Implement multi-factor authentication (MFA) for administrators with KMS key management permissions to prevent unauthorized access (Security Best Practices reference).
Enable AWS Config rules for KMS key state monitoring to continuously assess the configuration of KMS keys and detect deviations from desired states (Security Best Practices reference).

AWS Key Management Service (KMS) - CraftedSignal Threat Feed

AWS KMS Key User Performing S3 Encryption Detection

Attack Chain

Impact

Recommendation

AWS KMS Customer Managed Key Disabled or Scheduled for Deletion

Attack Chain

Impact

Recommendation