KMS key policy was changed

Synopsis

Field	Value
Activation Period	14 Days
Training Period	30 Days
Test Period	N/A (single event)
Deduplication Period	1 Day
Required Data	AWS Audit Log
Detection Modules	Cloud
Detector Tags	Data Detection & Response
ATT&CK Tactic	Privilege Escalation (TA0004), Persistence (TA0003)
ATT&CK Technique	Account Manipulation (T1098), Account Manipulation: Additional Cloud Credentials (T1098.001)
Severity	Informational

Description

A cloud identity modified an AWS KMS key policy.

Attacker's Goals

Modify KMS key policies to gain unauthorized access to encrypted data or to deny access to resources encrypted using this key.

Investigative actions

• Investigate any unusual activity originating from the suspected identity.
• Confirm if the identity is authorized to modify KMS key policies.
• Review the KMS key policy changes to ensure they are legitimate.

Variations

KMS key policy was modified to include a foreign principal

Synopsis

Field	Value
ATT&CK Tactic	Impact (TA0040)
ATT&CK Technique	Data Encrypted for Impact (T1486), Data Destruction (T1485)
Severity	Medium

Description

A cloud identity modified a KMS key policy to include a foreign principal in an unknown account while bypassing the AWS PutKeyPolicy safety check. This could lead to a 'lockout' state where no users in the account have permission to manage or use the key, effectively making encrypted data irrecoverable.

Attacker's Goals

• Grant access to encryption keys to an external account under their control.
• Permanently deny access to encrypted data by creating a key policy lockout state, typical of data destruction or ransomware attacks.

Investigative actions

• Verify if the foreign principal is authorized to have access to this key.
• Investigate the relationship between the current account and the foreign account.
• Review the extent of permissions granted to the foreign principal.

Unusual KMS key policy modification

Synopsis

Field	Value
ATT&CK Tactic	Privilege Escalation (TA0004), Persistence (TA0003)
ATT&CK Technique	Account Manipulation (T1098), Account Manipulation: Additional Cloud Credentials (T1098.001)
Severity	Medium

Description

A Cloud identity that usually does not perform this action modified an AWS KMS key policy.

Attacker's Goals

Modify KMS key policies to gain unauthorized access to encrypted data or to deny access to resources encrypted using this key.

Investigative actions

• Investigate any unusual activity originating from the suspected identity.
• Confirm if the identity is authorized to modify KMS key policies.
• Review the KMS key policy changes to ensure they are legitimate.

Failed attempt to change KMS key policy

Synopsis

Field	Value
ATT&CK Tactic	Privilege Escalation (TA0004), Persistence (TA0003)
ATT&CK Technique	Account Manipulation (T1098), Account Manipulation: Additional Cloud Credentials (T1098.001)
Severity	Low

Description

A cloud identity failed to modify an AWS KMS key policy.

Attacker's Goals

Modify KMS key policies to gain unauthorized access to encrypted data or to deny access to resources encrypted using this key.

Investigative actions

• Investigate any unusual activity originating from the suspected identity.
• Confirm if the identity is authorized to modify KMS key policies.
• Review the KMS key policy changes to ensure they are legitimate.