attack.t1608.003 | Detection.FYI

AWS KMS Imported Key Material Usage

Oct 28, 2025 · attack.impact attack.t1486 attack.resource-development attack.t1608.003 ·
Share on:

Detects the import or deletion of key material in AWS KMS, which can be used as part of ransomware attacks. This activity is uncommon and provides a high certainty signal.

Read More