AWS KMS Imported Key Material Usage

Status: experimental
Severity: high
Log source: product aws, service cloudtrail
Author: toopricey
Source: github.com/SigmaHQ/sigma

Detects the import or deletion of key material in AWS KMS, which can be used as part of ransomware attacks. This activity is uncommon and provides a high certainty signal.

Known false positives

Legitimate use cases for imported key material are rare, but may include, Organizations with hybrid cloud architectures that import external key material for compliance requirements.
Development or testing environments that simulate external key management scenarios. Even in these cases, such activity is typically infrequent and should not add significant noise.

MITRE ATT&CK coverage

Tactic	Techniques
Resource Development	`T1608.003` Stage Capabilities: Install Digital Certificate
Impact	`T1486` Data Encrypted for Impact

Telemetry coverage

Platform	Record / event type
AWS	CloudTrail event `DeleteImportedKeyMaterial`: Deletes key material that was previously imported into a customer-managed KMS key, rendering the key unusable until new material is imported.
AWS	CloudTrail event `ImportKeyMaterial`: Imports cryptographic key material into a KMS key that was created with no key material, enabling the caller to supply their own key material.

Rules detecting the same action

These rules filter on the same operation.

AWS KMS Imported Key Material Deleted (Elastic)

Rule body

title: AWS KMS Imported Key Material Usage
id: 1279262f-1464-422f-ac0d-5b545320c526
status: experimental
description: |
    Detects the import or deletion of key material in AWS KMS, which can be used as part of ransomware attacks. This activity is uncommon and provides a high certainty signal.
references:
    - https://www.chrisfarris.com/post/effective-aws-ransomware/
    - https://docs.aws.amazon.com/kms/latest/developerguide/ct-importkeymaterial.html
    - https://docs.aws.amazon.com/kms/latest/developerguide/ct-deleteimportedkeymaterial.html
author: toopricey
date: 2025-10-18
tags:
    - attack.impact
    - attack.t1486
    - attack.resource-development
    - attack.t1608.003
logsource:
    product: aws
    service: cloudtrail
detection:
    selection:
        eventSource: 'kms.amazonaws.com'
        eventName:
            - 'ImportKeyMaterial'
            - 'DeleteImportedKeyMaterial'
    condition: selection
falsepositives:
    - Legitimate use cases for imported key material are rare, but may include, Organizations with hybrid cloud architectures that import external key material for compliance requirements.
    - Development or testing environments that simulate external key management scenarios. Even in these cases, such activity is typically infrequent and should not add significant noise.
level: high

Stages and Predicates

Stage 0: `condition`

selection

Stage 1: `selection`

selection:
    eventSource: 'kms.amazonaws.com'
    eventName:
        - 'ImportKeyMaterial'
        - 'DeleteImportedKeyMaterial'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`eventName`	eq	`DeleteImportedKeyMaterial` `ImportKeyMaterial`	`field:"aws::eventName" kind:eq`
`eventSource`	eq	`kms.amazonaws.com`	`field:"aws::eventSource" kind:eq value:"kms.amazonaws.com"`