You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
[Rule Tuning] AWS S3 Object Encryption Using External KMS Key
Rule is alerting as expected, with low telemetry volume. Updates to rule query are to provide more alert context as an ESQL rule.
- reduced execution window
- added additional fields for more alert context, include customer-requested `data_stream.namespace` field
- added highlighted fields
- updated description and investigation guide
Identifies `CopyObject` events within an S3 bucket using an AWS KMS key from an external account for encryption.
11
-
Adversaries with access to a misconfigured S3 bucket and the proper permissions may encrypt objects with an external KMS
12
-
key to deny their victims access to their own data.
10
+
Identifies use of the S3 CopyObject API where the destination object is encrypted using an AWS KMS key from an external
11
+
AWS account. This behavior may indicate ransomware-style impact activity where an adversary with access to a
12
+
misconfigured S3 bucket encrypts objects using a KMS key they control, preventing the bucket owner from decrypting their
13
+
own data. This technique is a critical early signal of destructive intent or cross-account misuse.
13
14
"""
14
15
false_positives = [
15
16
"""
16
-
Administrators within an AWS Organization structure may legitimately encrypt bucket objects with a key from an
17
-
account different from the target bucket. Ensure that this behavior is not part of a legitimate operation before
18
-
taking action.
17
+
Cross-account KMS key usage may be legitimate in multi-account AWS Organizations architectures where centralized
18
+
encryption keys are used for data governance or auditing workflows. Confirm whether the external KMS key belongs to
19
+
an expected account before taking action. Data migration or cross-account backup workflows may legitimately
20
+
re-encrypt S3 objects using a key in another account. Ensure these workflows are documented, tied to known IAM
21
+
roles, and occur on predictable schedules.
19
22
""",
20
23
]
21
-
from = "now-9m"
24
+
from = "now-6m"
22
25
language = "esql"
23
26
license = "Elastic License v2"
24
27
name = "AWS S3 Object Encryption Using External KMS Key"
25
28
note = """## Triage and analysis
26
29
27
-
### Investigating AWS S3 Object Encryption Using External KMS Key
28
-
29
-
This rule detects the use of an external AWS KMS key to encrypt objects within an S3 bucket. Adversaries with access to a misconfigured S3 bucket may use an external key to copy objects within a bucket and deny victims the ability to access their own data.
30
-
This rule uses [ESQL](https://www.elastic.co/guide/en/security/current/rules-ui-create.html#create-esql-rule) to look for use of the `CopyObject` operation where the target bucket's `cloud.account.id` is different from the `key.account.id` dissected from the AWS KMS key used for encryption.
31
-
32
-
#### Possible Investigation Steps:
33
-
34
-
- **Identify the Actor**: Review the `aws.cloudtrail.user_identity.arn` and `aws.cloudtrail.user_identity.access_key_id` fields to identify who performed the action. Verify if this actor typically performs such actions and if they have the necessary permissions.
35
-
- **Review the Request Details**: Examine the `aws.cloudtrail.request_parameters` to understand the specific details of the `CopyObject` action. Look for any unusual parameters that could suggest unauthorized or malicious modifications or usage of an unknown KMS keyId.
36
-
- **Analyze the Source of the Request**: Investigate the `source.ip` and `source.geo` fields to determine the geographical origin of the request. An external or unexpected location might indicate compromised credentials or unauthorized access.
37
-
- **Contextualize with Timestamp**: Use the `@timestamp` field to check when the object was copied. Changes during non-business hours or outside regular maintenance windows might require further scrutiny.
38
-
- **Correlate with Other Activities**: Search for related CloudTrail events before and after this action to see if the same actor or IP address engaged in other potentially suspicious activities.
39
-
- **Check for Object Deletion or Access**: Look for `DeleteObject`, `DeleteObjects`, or `GetObject` API calls to the same S3 bucket that may indicate the adversary accessing and destroying objects including older object versions.
40
-
- **Interview Relevant Personnel**: If the copy event was initiated by a user, verify the intent and authorization for this action with the person or team responsible for managing S3 buckets.
41
-
42
-
### False Positive Analysis:
43
-
44
-
- **Legitimate Administrative Actions**: Confirm if the `CopyObject` action aligns with scheduled updates, maintenance activities, or legitimate administrative tasks documented in change management systems.
45
-
- **Consistency Check**: Compare the action against historical data of similar activities performed by the user or within the organization. If the action is consistent with past legitimate activities, it might indicate a false alarm.
46
-
47
-
### Response and Remediation:
30
+
> **Disclaimer**:
31
+
> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance.
32
+
> While every effort has been made to ensure its quality, validate and adapt it to suit your operational needs.
48
33
49
-
- **Immediate Review**: If the activity was unauthorized, search for potential ransom note placed in S3 bucket and review the bucket's access logs for any suspicious activity.
50
-
- **Enhance Monitoring and Alerts**: Adjust monitoring systems to alert on similar `CopyObject` actions, especially those involving sensitive data or unusual file extensions.
51
-
- **Educate and Train**: Provide additional training to users with administrative rights on the importance of security best practices concerning S3 bucket management and the risks of ransomware.
52
-
- **Audit S3 Bucket Policies and Permissions**: Conduct a comprehensive audit of all S3 bucket policies and associated permissions to ensure they adhere to the principle of least privilege.
53
-
- **Incident Response**: If there's an indication of malicious intent or a security breach, initiate the incident response protocol to mitigate any damage and prevent future occurrences.
54
-
55
-
### Additional Information:
34
+
### Investigating AWS S3 Object Encryption Using External KMS Key
56
35
57
-
For further guidance on managing S3 bucket security and protecting against ransomware, refer to the [AWS S3 documentation](https://docs.aws.amazon.com/AmazonS3/latest/userguide/Welcome.html) and AWS best practices for security. Additionally, consult the following resources for specific details on S3 ransomware protection:
58
-
- [ERMETIC REPORT - AWS S3 Ransomware Exposure in the Wild](https://s3.amazonaws.com/bizzabo.file.upload/PtZzA0eFQwV2RA5ysNeo_ERMETIC%20REPORT%20-%20AWS%20S3%20Ransomware%20Exposure%20in%20the%20Wild.pdf)
59
-
- [S3 Ransomware Part 1: Attack Vector](https://rhinosecuritylabs.com/aws/s3-ransomware-part-1-attack-vector/)
36
+
This rule detects when an S3 `CopyObject` operation encrypts an object using a KMS key belonging to a different AWS account than the bucket owner. This behavior is unusual and a strong indicator of:
37
+
38
+
- Cloud ransomware techniques, where adversaries encrypt data using a key only they control.
39
+
- Cross-account privilege misuse, especially when an unauthorized principal has write access to S3.
40
+
- Misconfigured bucket permissions, enabling principals from another account to perform privileged copy operations.
41
+
- Early impact-stage activity in incidents where attackers prepare to destroy availability or deny the owner access.
42
+
43
+
The rule uses ESQL to identify cases where the `cloud.account.id` (bucket owner) differs from the dissected `kms_key_account_id` used for encrypting the new object version.
44
+
45
+
46
+
#### Possible investigation steps
47
+
48
+
**Identify the actor and access pathway**
49
+
- Review `aws.cloudtrail.user_identity.arn` and `aws.cloudtrail.user_identity.access_key_id`.
50
+
- Check whether the caller is:
51
+
- A legitimate cross-account automation role,
52
+
- A compromised IAM user or workload identity, or
53
+
- A federated identity behaving outside of normal patterns.
54
+
- Inspect `user_agent.original` to determine whether the action came from the AWS Console, CLI, SDK, or unusual tooling.
- **Security Best Practices:** [AWS Knowledge Center – Security Best Practices](https://aws.amazon.com/premiumsupport/knowledge-center/security-best-practices/).
0 commit comments