LoFP / legitimate administrative actions by authorized users importing keys for valid purposes.

Techniques

• t1078

Sample rules

AWS Key Pair Import Activity

• source: sigma
• technicques:
  • t1078

Description

Detects the import of SSH key pairs into AWS EC2, which may indicate an attacker attempting to gain unauthorized access to instances. This activity could lead to initial access, persistence, or privilege escalation, potentially compromising sensitive data and operations.

Detection logic

condition: selection
selection:
  eventName: ImportKeyPair
  eventSource: ec2.amazonaws.com