AWS EC2 ImportKeyPair CloudTrail Activity

Flags CloudTrail EC2 ImportKeyPair events that may indicate newly imported SSH key access setup.

FreeUnreviewedSigmamediumv1

aws-ec2-importkeypair-cloudtrail-activity-92f84194

title: AWS EC2 ImportKeyPair CloudTrail Activity
id: 041b85cd-0706-460d-ba25-4a42ab39fcae
status: experimental
description: This rule identifies CloudTrail events where AWS EC2 key pairs are imported via the ImportKeyPair API. Attackers may use this capability to establish or enable SSH-based access to instances they can later target. The detection relies on CloudTrail telemetry fields for eventSource and eventName matching ec2.amazonaws.com and ImportKeyPair.
references:
  - https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ImportKeyPair.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/aws/cloudtrail/aws_ec2_import_key_pair_activity.yml
author: Ivan Saakov, Huntrule Team
date: 2024-12-19
tags:
  - attack.initial-access
  - attack.stealth
  - attack.t1078
  - attack.persistence
  - attack.privilege-escalation
logsource:
  product: aws
  service: cloudtrail
detection:
  selection:
    eventSource: ec2.amazonaws.com
    eventName: ImportKeyPair
  condition: selection
falsepositives:
  - Legitimate administrative actions by authorized users importing keys for valid purposes.
  - Automated processes for infrastructure setup may trigger this alert.
  - Verify the user identity, user agent, and source IP address to ensure they are expected.
level: medium
license: DRL-1.1
related:
  - id: 92f84194-8d9a-4ee0-8699-c30bfac59780
    type: derived

What it detects

This rule identifies CloudTrail events where AWS EC2 key pairs are imported via the ImportKeyPair API. Attackers may use this capability to establish or enable SSH-based access to instances they can later target. The detection relies on CloudTrail telemetry fields for eventSource and eventName matching ec2.amazonaws.com and ImportKeyPair.

Known false positives

Legitimate administrative actions by authorized users importing keys for valid purposes.
Automated processes for infrastructure setup may trigger this alert.
Verify the user identity, user agent, and source IP address to ensure they are expected.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.