Suspicious AWS Key Pair Import Behavior (via cloudtrail)

title: Suspicious AWS Key Pair Import Behavior (via cloudtrail)
id: 976ba5c6-7236-5e27-957e-3d9a90222fa1
status: stable
description: This rule detects the import of SSH key pairs into AWS EC2, which may indicate an adversary attempting to gain unauthorized access to instances. This behavior could lead to initial access, persistence, or privilege escalation, potentially compromising sensitive data and operations.
references:
    - https://attack.mitre.org/techniques/T1078/
    - https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ImportKeyPair.html
author: Huntrule Team
date: 2026-01-20
tags:
    - attack.initial-access
    - attack.stealth
    - attack.t1078
    - attack.persistence
    - attack.privilege-escalation
logsource:
    product: aws
    service: cloudtrail
detection:
    selection:
        eventSource: 'ec2.amazonaws.com'
        eventName: 'ImportKeyPair'
    condition: selection
falsepositives:
    - Unknown
level: medium