Product
medium
advisory
Detecting S3 Ransomware via Cross-Account KMS Encryption
1 TTPAdversaries leverage S3 CopyObject API calls to encrypt data within victim buckets using external, attacker-controlled KMS keys, effectively denying access to the bucket owner.
S3 +3
cloud
aws
ransomware
impact
1t
updated
medium
advisory
AWS KMS Key Policy Updated via PutKeyPolicy
2 rules 2 TTPsDetection of successful PutKeyPolicy calls on AWS KMS keys to identify potential privilege escalation or unauthorized access by adversaries modifying key policies to decrypt or exfiltrate data.
KMS
cloud
aws
privilege-escalation
defense-evasion
2r
2t
medium
advisory
AWS User Performing S3 Encryption with KMS Keys
2 rules 1 TTPA user with KMS keys is performing encryption operations on S3 buckets, potentially masking exfiltration or tampering efforts by encrypting sensitive data to evade detection or preparing it for exfiltration.
S3 +1
aws
encryption
ransomware
2r
1t