AWS KMS Imported Key Material Import or Deletion via CloudTrail

title: AWS KMS Imported Key Material Import or Deletion via CloudTrail
id: 777936c4-6b97-4617-9af2-219e68a64890
status: experimental
description: This rule identifies AWS Key Management Service actions that import or delete imported key material, which can be leveraged to change encryption key material used by protected resources. Such operations are uncommon in typical environments and can indicate an attacker preparing, modifying, or removing externally sourced key material. It relies on AWS CloudTrail events with eventSource set to kms.amazonaws.com and eventName matching ImportKeyMaterial or DeleteImportedKeyMaterial.
references:
  - https://www.chrisfarris.com/post/effective-aws-ransomware/
  - https://docs.aws.amazon.com/kms/latest/developerguide/ct-importkeymaterial.html
  - https://docs.aws.amazon.com/kms/latest/developerguide/ct-deleteimportedkeymaterial.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/aws/cloudtrail/aws_kms_import_key_material.yml
author: toopricey, Huntrule Team
date: 2025-10-18
tags:
  - attack.impact
  - attack.t1486
  - attack.resource-development
  - attack.t1608.003
logsource:
  product: aws
  service: cloudtrail
detection:
  selection:
    eventSource: kms.amazonaws.com
    eventName:
      - ImportKeyMaterial
      - DeleteImportedKeyMaterial
  condition: selection
falsepositives:
  - Legitimate use cases for imported key material are rare, but may include, Organizations with hybrid cloud architectures that import external key material for compliance requirements.
  - Development or testing environments that simulate external key management scenarios. Even in these cases, such activity is typically infrequent and should not add significant noise.
level: high
license: DRL-1.1
related:
  - id: 1279262f-1464-422f-ac0d-5b545320c526
    type: derived