AWS CloudTrail: KMS Imported Key Material Use (ImportKeyMaterial/ DeleteImportedKeyMaterial)

title: "AWS CloudTrail: KMS Imported Key Material Use (ImportKeyMaterial/ DeleteImportedKeyMaterial)"
id: 777936c4-6b97-4617-9af2-219e68a64890
status: experimental
description: This rule flags AWS KMS CloudTrail events where key material is imported or where previously imported key material is deleted. Attackers can use imported key material to enable encryption/decryption operations and support impact-focused campaigns, making this an uncommon activity worth investigating. It relies on CloudTrail telemetry from kms.amazonaws.com for the ImportKeyMaterial and DeleteImportedKeyMaterial event names.
references:
  - https://www.chrisfarris.com/post/effective-aws-ransomware/
  - https://docs.aws.amazon.com/kms/latest/developerguide/ct-importkeymaterial.html
  - https://docs.aws.amazon.com/kms/latest/developerguide/ct-deleteimportedkeymaterial.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/aws/cloudtrail/aws_kms_import_key_material.yml
author: toopricey, Huntrule Team
date: 2025-10-18
tags:
  - attack.impact
  - attack.t1486
  - attack.resource-development
  - attack.t1608.003
logsource:
  product: aws
  service: cloudtrail
detection:
  selection:
    eventSource: kms.amazonaws.com
    eventName:
      - ImportKeyMaterial
      - DeleteImportedKeyMaterial
  condition: selection
falsepositives:
  - Legitimate use cases for imported key material are rare, but may include, Organizations with hybrid cloud architectures that import external key material for compliance requirements.
  - Development or testing environments that simulate external key management scenarios. Even in these cases, such activity is typically infrequent and should not add significant noise.
level: high
license: DRL-1.1
related:
  - id: 1279262f-1464-422f-ac0d-5b545320c526
    type: derived