Tag
AWS KMS Imported Key Material Deleted
1 rule 1 TTPAdversaries leverage the `DeleteImportedKeyMaterial` API call against AWS KMS customer managed keys (CMKs) with external material, instantly rendering encrypted data inaccessible with no recovery window, facilitating cloud ransomware or data destruction attacks.
AWS KMS Key User Performing S3 Encryption
2 rules 1 TTPDetection of AWS users employing KMS keys for S3 encryption, potentially indicating suspicious data handling within cloud environments.
AWS KMS Key Policy Updated via PutKeyPolicy
2 rules 2 TTPsDetection of successful PutKeyPolicy calls on AWS KMS keys to identify potential privilege escalation or unauthorized access by adversaries modifying key policies to decrypt or exfiltrate data.
AWS KMS Key User Performing S3 Encryption Detection
2 rules 1 TTPDetection of AWS users utilizing KMS keys to perform encryption operations on S3 buckets, indicating potential misuse or malicious activity within the cloud environment.
AWS KMS Customer Managed Key Disabled or Scheduled for Deletion
2 rules 1 TTPAn adversary may disable or schedule the deletion of an AWS customer-managed KMS Key to cause irreversible data loss, disrupt business operations, impede incident response, or hide evidence of prior activity.
AWS KMS Key Creation with Public Encryption Policy
2 rules 1 TTPAn attacker may create AWS KMS keys with a permissive encryption policy, granting `kms:Encrypt` permissions to all principals, potentially leading to unauthorized encryption and data compromise across multiple organizations.