AWS KMS mass decrypt
A single identity called KMS Decrypt or GenerateDataKey repeatedly in a short window.
What it detects
A single identity called KMS Decrypt or GenerateDataKey repeatedly in a short window.
Bulk key use is the cloud shape of both mass data access and ransomware: to read a bucket of encrypted objects, or to re-encrypt them under a key the victim does not control, every object must go through KMS, and CloudTrail records each call. The volume is the signal — one decrypt is meaningless, thousands from an identity that normally issues none is not.
MITRE ATT&CK mapping
False positives and triage
UNMEASURED FALSE-POSITIVE RATE — this is the one cloud rule in the pack with no corpus evidence behind its threshold. The benchmark corpus's KMS capture turned out to contain only background service traffic (its densest 10-minute window is 20 calls, from a monitoring pipeline), so it neither confirms nor refutes this rule; the count of 50 is reasoned, not fitted, and the rule is marked experimental until real bulk decryption is observed. Its positive fixture is hand-written for that reason.
Applications that use SSE-KMS decrypt constantly and legitimately — a service reading an encrypted bucket will cross this threshold on every ordinary batch job, so a per-principal baseline is required before this number means anything. Severity is deliberately moderate for that reason. The signal is bulk decryption by an identity with no history of it, from a new IP or region, or paired with ReEncrypt (re-encryption under a different key is the ransomware shape, not the read shape).
The rule
Declarative YAML read by the detection engine — data, never executed. Confidence 50%. Source: rules/cloud/aws_kms_mass_decrypt.yaml, licensed under the Apache License 2.0.
id: cloud.aws.kms_mass_decrypt
version: 1.0.0
status: experimental
severity: medium
confidence: 0.5
platforms: [application]
mitre_techniques: [T1486, T1530]
description: |
A single identity called KMS `Decrypt` or `GenerateDataKey` repeatedly in a short
window.
Bulk key use is the cloud shape of both mass data access and ransomware: to read a
bucket of encrypted objects, or to re-encrypt them under a key the victim does not
control, every object must go through KMS, and CloudTrail records each call. The
volume is the signal — one decrypt is meaningless, thousands from an identity that
normally issues none is not.
match:
provider: AWS
event_action_any:
- Decrypt
- GenerateDataKey
- GenerateDataKeyWithoutPlaintext
- ReEncrypt
threshold:
count: 50
window_seconds: 600
group_by: [user_name]
correlation_keys: [user_name]
false_positive_guidance: |
UNMEASURED FALSE-POSITIVE RATE — this is the one cloud rule in the pack with no
corpus evidence behind its threshold. The benchmark corpus's KMS capture turned out
to contain only background service traffic (its densest 10-minute window is 20 calls,
from a monitoring pipeline), so it neither confirms nor refutes this rule; the count
of 50 is reasoned, not fitted, and the rule is marked experimental until real bulk
decryption is observed. Its positive fixture is hand-written for that reason.
Applications that use SSE-KMS decrypt constantly and legitimately — a service
reading an encrypted bucket will cross this threshold on every ordinary batch job,
so a per-principal baseline is required before this number means anything.
Severity is deliberately moderate for that reason. The signal is bulk decryption
by an identity with no history of it, from a new IP or region, or paired with
`ReEncrypt` (re-encryption under a different key is the ransomware shape, not the
read shape).
Related detections
Run this rule on your own logs — offline
KIROSEC runs this rule and the rest of the library over Windows, Linux, macOS and cloud audit logs on the analyst's own machine. Every alert links to the events that raised it, and nothing leaves the device.