aws_kms_import_key_material

SigmaHQ Detections@sigmaHQ

•updated Oct 28, 2025•3•0•77

Detects the import or deletion of key material in AWS KMS, which can be used as part of ransomware attacks. This activity is uncommon and provides a high certainty signal.