AWS KMS Imported Key Material Import or Deletion via CloudTrail
Detects AWS KMS imported key material events in CloudTrail, including import and deletion of imported key material.
- Product
- aws
- Service
- cloudtrail
- Author
- toopricey (SigmaHQ), DRL 1.1
- Published
- 2025-10-18
- Updated
- 2026-07-31
ATT&CK techniques
Resource Dev → ImpactRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
What it detects
This rule identifies AWS Key Management Service actions that import or delete imported key material, which can be leveraged to change encryption key material used by protected resources. Such operations are uncommon in typical environments and can indicate an attacker preparing, modifying, or removing externally sourced key material. It relies on AWS CloudTrail events with eventSource set to kms.amazonaws.com and eventName matching ImportKeyMaterial or DeleteImportedKeyMaterial.
Reporting behind it
- chrisfarris.comhttps://www.chrisfarris.com/post/effective-aws-ransomware/
- docs.aws.amazon.comhttps://docs.aws.amazon.com/kms/latest/developerguide/ct-importkeymaterial.html
- docs.aws.amazon.comhttps://docs.aws.amazon.com/kms/latest/developerguide/ct-deleteimportedkeymaterial.html
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/cloud/aws/cloudtrail/aws_kms_import_key_material.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: AWS KMS Imported Key Material Import or Deletion via CloudTrail
id: 777936c4-6b97-4617-9af2-219e68a64890
status: experimental
description: This rule identifies AWS Key Management Service actions that import or delete imported key material, which can be leveraged to change encryption key material used by protected resources. Such operations are uncommon in typical environments and can indicate an attacker preparing, modifying, or removing externally sourced key material. It relies on AWS CloudTrail events with eventSource set to kms.amazonaws.com and eventName matching ImportKeyMaterial or DeleteImportedKeyMaterial.
references:
- https://www.chrisfarris.com/post/effective-aws-ransomware/
- https://docs.aws.amazon.com/kms/latest/developerguide/ct-importkeymaterial.html
- https://docs.aws.amazon.com/kms/latest/developerguide/ct-deleteimportedkeymaterial.html
- https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/aws/cloudtrail/aws_kms_import_key_material.yml
author: toopricey, Huntrule Team
date: 2025-10-18
tags:
- attack.impact
- attack.t1486
- attack.resource-development
- attack.t1608.003
logsource:
product: aws
service: cloudtrail
detection:
selection:
eventSource: kms.amazonaws.com
eventName:
- ImportKeyMaterial
- DeleteImportedKeyMaterial
condition: selection
falsepositives:
- Legitimate use cases for imported key material are rare, but may include, Organizations with hybrid cloud architectures that import external key material for compliance requirements.
- Development or testing environments that simulate external key management scenarios. Even in these cases, such activity is typically infrequent and should not add significant noise.
level: high
license: DRL-1.1
related:
- id: 1279262f-1464-422f-ac0d-5b545320c526
type: derived