Suspicious overly permissive KMS key policy created

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · 📊

Back to Content Index


An overly permissive key policy was created, resulting in KMS keys where the kms:Encrypt action is accessible to everyone (even outside of the organization). This could mean that your account is compromised and that the attacker is using the encryption key to compromise other organizations.

Attribute Value
Type Analytic Rule
Solution Amazon Web Services
ID 60dfc193-0f73-4279-b43c-110ade02b201
Severity High
Status Available
Kind Scheduled
Tactics Impact
Techniques T1486
Required Connectors AWS
Source View on GitHub

Tables Used

This content item queries data from the following tables:

Table Selection Criteria Transformations Ingestion API Lake-Only
AWSCloudTrail EventName in "CreateKey,PutKeyPolicy" ?

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · 📊

Back to Analytic Rules · Back to Amazon Web Services