Detecting ransomware activities within AWS environments
You are an Amazon Web Services (AWS) admin who manages AWS resources and services across your organization. As part of your role, you need to be able to detect potential ransomware attacks that occur via your AWS resources.
Cloud ransomware can be deployed when attackers obtain high-privileged credentials from targeted users or resources. The searches in this use case help you to detect when users in your AWS environment are performing activities that are commonly associated with ransomware attacks, namely through the creation of KMS keys and encryption activities.