THE COMPLEXITY OF DETECTING AMAZON S3 AND KMS RANSOMWARE

Summary from the TLDR InfoSec newsletter

S3 and KMS ransomware attacks are challenging to detect, as many techniques can only be detected in S3 Access Logs or CloudTrail data events, which can be costly and are not enabled by default. This post provides IoCs for 11 different indicators of cloud ransomware. It also includes an advanced event selector for CloudTrail, which can target a specific bucket to enable more fine-grained logging on sensitive buckets.