Detection rules › By event

AWS-kms

Event	Rules
DeleteImportedKeyMaterial	2
DisableKey	3
ImportKeyMaterial	1
ListAliases	1
ListKeys	1
PutKeyPolicy	5
ScheduleKeyDeletion	3

DeleteImportedKeyMaterial

2 detection rules reference this event. View event page.

Sigma (1)

AWS KMS Imported Key Material Usage severity high T1486, T1608, T1608.003

Elastic (1)

AWS KMS Imported Key Material Deleted severity medium T1485, T1485.001

DisableKey

3 detection rules reference this event. View event page.

Elastic (1)

AWS KMS Customer Managed Key Disabled or Scheduled for Deletion severity medium T1485, T1485.001

YARA-L (1)

AWS KMS Key Disabled Or Scheduled For Deletion severity high T1485

Panther (1)

KMS CMK Disabled or Deleted severity informational T1485

ImportKeyMaterial

1 detection rules reference this event. View event page.

Sigma (1)

AWS KMS Imported Key Material Usage severity high T1486, T1608, T1608.003

ListAliases

1 detection rules reference this event. View event page.

Elastic (1)

AWS Discovery API Calls from VPN ASN for the First Time by Identity severity high T1526, T1580

ListKeys

1 detection rules reference this event. View event page.

Elastic (1)

AWS Discovery API Calls from VPN ASN for the First Time by Identity severity high T1526, T1580

PutKeyPolicy

5 detection rules reference this event. View event page.

Elastic (1)

AWS KMS Key Policy Updated via PutKeyPolicy severity medium T1548, T1548.005, T1685

Splunk (2)

ASL AWS Detect Users creating keys with encrypt policy without MFA severity medium T1486
AWS Detect Users creating keys with encrypt policy without MFA severity medium T1486

Kusto (2)

AWSCloudTrail - Creating keys with encrypt policy without MFA severity medium T1485
AWSCloudTrail - Suspicious overly permissive KMS key policy created severity high T1486

ScheduleKeyDeletion

3 detection rules reference this event. View event page.

Elastic (1)

AWS KMS Customer Managed Key Disabled or Scheduled for Deletion severity medium T1485, T1485.001

YARA-L (1)

AWS KMS Key Disabled Or Scheduled For Deletion severity high T1485

Panther (1)

KMS CMK Disabled or Deleted severity informational T1485