1type: trigger
2name: crowdsecurity/aws-cis-benchmark-kms-deletion
3description: "Detect AWS KMS key deletion"
4filter: |
5  evt.Meta.log_type == 'aws-cloudtrail' &&
6  evt.Unmarshaled.cloudtrail.eventSource == "kms.amazonaws.com" &&
7  (evt.Meta.event_name == "DisableKey" || evt.Meta.event_name == "ScheduleKeyDeletion")
8labels:
9  confidence: 3
10  spoofable: 0
11  classification:
12    - attack.T1485
13  behavior: "cloud:audit"
14  label: "AWS KMS indicator removal"
15  service: aws
16  cti: false
17  remediation: false
18