AWS KMS Customer Managed Key Disabled or Scheduled for Deletion

 1[metadata]
 2creation_date = "2022/09/21"
 3integration = ["aws"]
 4maturity = "production"
 5min_stack_comments = "AWS integration breaking changes, bumping version to ^2.0.0"
 6min_stack_version = "8.9.0"
 7updated_date = "2024/04/14"
 8
 9[rule]
10author = ["Xavier Pich"]
11description = """
12Identifies attempts to disable or schedule the deletion of an AWS KMS Customer Managed Key (CMK). Deleting an AWS KMS
13key is destructive and potentially dangerous. It deletes the key material and all metadata associated with the KMS key
14and is irreversible. After a KMS key is deleted, the data that was encrypted under that KMS key can no longer be
15decrypted, which means that data becomes unrecoverable.
16"""
17false_positives = [
18    """
19    A KMS customer managed key may be disabled or scheduled for deletion by a system administrator. Verify whether the
20    user identity, user agent, and/or hostname should be making changes in your environment. Key deletions by unfamiliar
21    users should be investigated. If known behavior is causing false positives, it can be exempted from the rule.
22    """,
23]
24from = "now-60m"
25index = ["filebeat-*", "logs-aws.cloudtrail-*"]
26interval = "10m"
27language = "kuery"
28license = "Elastic License v2"
29name = "AWS KMS Customer Managed Key Disabled or Scheduled for Deletion"
30note = """## Setup
31
32The AWS Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule."""
33references = [
34    "https://docs.aws.amazon.com/cli/latest/reference/kms/disable-key.html",
35    "https://docs.aws.amazon.com/cli/latest/reference/kms/schedule-key-deletion.html",
36]
37risk_score = 47
38rule_id = "6951f15e-533c-4a60-8014-a3c3ab851a1b"
39severity = "medium"
40tags = ["Domain: Cloud", "Data Source: AWS", "Data Source: Amazon Web Services", "Data Source: AWS KMS", "Use Case: Log Auditing", "Tactic: Impact"]
41timestamp_override = "event.ingested"
42type = "query"
43
44query = '''
45event.dataset:aws.cloudtrail and event.provider:kms.amazonaws.com and event.action:("DisableKey" or "ScheduleKeyDeletion") and event.outcome:success
46'''
47
48
49[[rule.threat]]
50framework = "MITRE ATT&CK"
51[[rule.threat.technique]]
52id = "T1485"
53name = "Data Destruction"
54reference = "https://attack.mitre.org/techniques/T1485/"
55
56
57[rule.threat.tactic]
58id = "TA0040"
59name = "Impact"
60reference = "https://attack.mitre.org/tactics/TA0040/"