{"id":"92f84194-8d9a-4ee0-8699-c30bfac59780","title":"AWS Key Pair Import Activity","description":"Detects the import of SSH key pairs into AWS EC2, which may indicate an attacker attempting to gain unauthorized access to instances. This activity could lead to initial access, persistence, or privilege escalation, potentially compromising sensitive data and operations.\n","author":"Ivan Saakov","status":"experimental","level":"medium","date":"2024-12-19","modified":"","tags":["attack.initial-access","attack.stealth","attack.t1078","attack.persistence","attack.privilege-escalation"],"technique_ids":["T1078"],"logsource":{"product":"aws","service":"cloudtrail"},"falsepositives":["Legitimate administrative actions by authorized users importing keys for valid purposes.","Automated processes for infrastructure setup may trigger this alert.","Verify the user identity, user agent, and source IP address to ensure they are expected."],"references":["https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ImportKeyPair.html"],"source_path":"rules/cloud/aws/cloudtrail/aws_ec2_import_key_pair_activity.yml","source_sha256":"72fba996a7e2313f7bbbff13e1ac3c0c96ff6b05e497a3426a419858325092e1","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/cloud/aws/cloudtrail/aws_ec2_import_key_pair_activity.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: AWS Key Pair Import Activity\nid: 92f84194-8d9a-4ee0-8699-c30bfac59780\nstatus: experimental\ndescription: |\n    Detects the import of SSH key pairs into AWS EC2, which may indicate an attacker attempting to gain unauthorized access to instances. This activity could lead to initial access, persistence, or privilege escalation, potentially compromising sensitive data and operations.\nreferences:\n    - https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ImportKeyPair.html\nauthor: Ivan Saakov\ndate: 2024-12-19\ntags:\n    - attack.initial-access\n    - attack.stealth\n    - attack.t1078\n    - attack.persistence\n    - attack.privilege-escalation\nlogsource:\n    product: aws\n    service: cloudtrail\ndetection:\n    selection:\n        eventSource: 'ec2.amazonaws.com'\n        eventName: 'ImportKeyPair'\n    condition: selection\nfalsepositives:\n    - Legitimate administrative actions by authorized users importing keys for valid purposes.\n    - Automated processes for infrastructure setup may trigger this alert.\n    - Verify the user identity, user agent, and source IP address to ensure they are expected.\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1078","id":"T1078","name":"Valid Accounts","page":"techniques/enterprise/T1078/"}],"data_path":"data/detection-rules/92f84194-8d9a-4ee0-8699-c30bfac59780.json","kind":"sigma"}