Skip to content
Threat Feed
Subscribe

Product

KMS

2 briefs RSS
medium advisory

AWS KMS Key Policy Updated via PutKeyPolicy

Detection of successful PutKeyPolicy calls on AWS KMS keys to identify potential privilege escalation or unauthorized access by adversaries modifying key policies to decrypt or exfiltrate data.

KMS cloud aws privilege-escalation defense-evasion
2r 2t
medium advisory

AWS User Performing S3 Encryption with KMS Keys

A user with KMS keys is performing encryption operations on S3 buckets, potentially masking exfiltration or tampering efforts by encrypting sensitive data to evade detection or preparing it for exfiltration.

S3 +1 aws encryption ransomware
2r 1t