AWSCloudTrail - Creating keys with encrypt policy without MFA

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

Back to Content Index


Identifies AWS KMS key creation or policy changes that allow kms:Encrypt or kms:* to any principal. This configuration can expose encryption capability outside approved boundaries and should be investigated as overly permissive or malicious.

Attribute Value
Type Analytic Rule
Solution Amazon Web Services
ID 454133a7-5427-4a7c-bdc4-0adfa84dda16
Severity Medium
Status Available
Kind Scheduled
Tactics Impact
Techniques T1485
Required Connectors AWS
Source View on GitHub

Tables Used

This content item queries data from the following tables:

Table Selection Criteria Transformations Ingestion API Lake-Only
AWSCloudTrail EventName in "CreateKey,PutKeyPolicy"

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

Back to Analytic Rules · Back to Amazon Web Services