1200kmSECURITY RESEARCH

1200KM / sigma-rule

AWS Key Pair Import Activity — Sigma Rule

Sigma rule 92f84194-8d9a-4ee0-8699-c30bfac59780. AWS Key Pair Import Activity — Sigma Rule. Detects the import of SSH key pairs into AWS EC2, which may indicate an attacker attempting to gain unauthorized access to instances. This activity could lead to initial access, persistence, or privilege escalation, potentially compromising sensitive data and operations.

Rule metadata and linked tags

experimentalmediumawscloudtrailattack.initial-accessattack.stealthattack.t1078attack.persistenceattack.privilege-escalation

Author: Ivan Saakov. Source status: experimental; severity: medium. Source dates: 2024-12-19 / not supplied.

{
  "product": "aws",
  "service": "cloudtrail"
}

Pinned original Sigma rule · Detection Rule License 1.1

Source SHA-256: 72fba996a7e2313f7bbbff13e1ac3c0c96ff6b05e497a3426a419858325092e1

Detection logic

Original source YAML. Source-tag agreement is not proof of complete semantic coverage. This rule has not been compiled for a SIEM backend or validated against live telemetry here.

title: AWS Key Pair Import Activity
id: 92f84194-8d9a-4ee0-8699-c30bfac59780
status: experimental
description: |
    Detects the import of SSH key pairs into AWS EC2, which may indicate an attacker attempting to gain unauthorized access to instances. This activity could lead to initial access, persistence, or privilege escalation, potentially compromising sensitive data and operations.
references:
    - https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ImportKeyPair.html
author: Ivan Saakov
date: 2024-12-19
tags:
    - attack.initial-access
    - attack.stealth
    - attack.t1078
    - attack.persistence
    - attack.privilege-escalation
logsource:
    product: aws
    service: cloudtrail
detection:
    selection:
        eventSource: 'ec2.amazonaws.com'
        eventName: 'ImportKeyPair'
    condition: selection
falsepositives:
    - Legitimate administrative actions by authorized users importing keys for valid purposes.
    - Automated processes for infrastructure setup may trigger this alert.
    - Verify the user identity, user agent, and source IP address to ensure they are expected.
level: medium

Original YAML and metadata in JSON

False positives

  • Legitimate administrative actions by authorized users importing keys for valid purposes.
  • Automated processes for infrastructure setup may trigger this alert.
  • Verify the user identity, user agent, and source IP address to ensure they are expected.

Source references

Connected ecosystem references

Exact source-tagged techniques

Telemetry review

Read the original logsource above, then inspect the linked detection workspaces for technique-level sensor context. No per-rule telemetry equivalence is inferred.

Pinned research references. No browser attack runner, live simulation result or validated detector is asserted. Source mappings and validation limits are preserved. ATT&CK / Atomic provenance · Detection provenance.