LoFP / a customer managed kms key may be disabled or scheduled for deletion by a system administrator. verify whether the user identity, user agent, and/or hostname should be making changes in your environment. key deletions by unfamiliar users should be investigated. if known behavior is causing false positives, it can be exempted from the rule.

Techniques

• T1485

Sample rules

AWS KMS Customer Managed Key Disabled or Scheduled for Deletion

• source: elastic
• technicques:
  • T1485

Description

Identifies attempts to disable or schedule the deletion of an AWS customer managed KMS Key. Disabling or scheduling a KMS key for deletion removes the ability to decrypt data encrypted under that key and can permanently destroy access to critical resources. Adversaries may use these operations to cause irreversible data loss, disrupt business operations, impede incident response, or hide evidence of prior activity. Because KMS keys often protect sensitive or regulated data, any modification to their lifecycle should be considered highly sensitive and investigated promptly.

Detection logic

event.dataset: "aws.cloudtrail"
    and event.provider: "kms.amazonaws.com" 
    and event.action: ("DisableKey" or "ScheduleKeyDeletion") 
    and event.outcome: "success"