AWS KMS Customer Managed Key Disabled or Scheduled for Deletion

 1[metadata]
 2creation_date = "2022/09/21"
 3integration = ["aws"]
 4maturity = "production"
 5updated_date = "2024/05/21"
 6
 7[rule]
 8author = ["Xavier Pich"]
 9description = """
10Identifies attempts to disable or schedule the deletion of an AWS KMS Customer Managed Key (CMK). Deleting an AWS KMS
11key is destructive and potentially dangerous. It deletes the key material and all metadata associated with the KMS key
12and is irreversible. After a KMS key is deleted, the data that was encrypted under that KMS key can no longer be
13decrypted, which means that data becomes unrecoverable.
14"""
15false_positives = [
16    """
17    A KMS customer managed key may be disabled or scheduled for deletion by a system administrator. Verify whether the
18    user identity, user agent, and/or hostname should be making changes in your environment. Key deletions by unfamiliar
19    users should be investigated. If known behavior is causing false positives, it can be exempted from the rule.
20    """,
21]
22from = "now-60m"
23index = ["filebeat-*", "logs-aws.cloudtrail-*"]
24interval = "10m"
25language = "kuery"
26license = "Elastic License v2"
27name = "AWS KMS Customer Managed Key Disabled or Scheduled for Deletion"
28note = """## Setup
29
30The AWS Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule."""
31references = [
32    "https://docs.aws.amazon.com/cli/latest/reference/kms/disable-key.html",
33    "https://docs.aws.amazon.com/cli/latest/reference/kms/schedule-key-deletion.html",
34]
35risk_score = 47
36rule_id = "6951f15e-533c-4a60-8014-a3c3ab851a1b"
37severity = "medium"
38tags = [
39    "Domain: Cloud",
40    "Data Source: AWS",
41    "Data Source: Amazon Web Services",
42    "Data Source: AWS KMS",
43    "Use Case: Log Auditing",
44    "Tactic: Impact",
45]
46timestamp_override = "event.ingested"
47type = "query"
48
49query = '''
50event.dataset:aws.cloudtrail and event.provider:kms.amazonaws.com and event.action:("DisableKey" or "ScheduleKeyDeletion") and event.outcome:success
51'''
52
53
54[[rule.threat]]
55framework = "MITRE ATT&CK"
56[[rule.threat.technique]]
57id = "T1485"
58name = "Data Destruction"
59reference = "https://attack.mitre.org/techniques/T1485/"
60
61
62[rule.threat.tactic]
63id = "TA0040"
64name = "Impact"
65reference = "https://attack.mitre.org/tactics/TA0040/"