Skip to content
Threat Feed
Subscribe
high advisory updated

Detection of Unauthorized AWS EC2 GetPasswordData API Access

Adversaries may attempt to retrieve EC2 administrator passwords via the GetPasswordData API to facilitate privilege escalation or lateral movement within AWS environments.

What's new

  • 1. added detection rule: AWS SSM Session Started to EC2 Instance Sep 19, 13:27 via elastic
  • 2. new product Sep 19, 13:18 via elastic
  • 3. added detection rule: Detect AWS EC2 Role GetCallerIdentity from New Source AS Sep 19, 01:06 via elastic
  • 4. added detection rule: Detect Unauthorized AWS Network ACL Creation Sep 18, 19:38 via elastic
  • 5. added detection rule: AWS EC2 EBS Snapshot Access Removed Sep 18, 19:35 via elastic

This threat brief identifies the risk of unauthorized use of the GetPasswordData API call within AWS environments. Adversaries who have gained initial access to a cloud account through compromised or over-privileged credentials may attempt to leverage this API to obtain the initial administrator password for Windows-based EC2 instances. This technique is often used to facilitate privilege escalation or lateral movement across the target network. While the API is a legitimate feature for system administration, its use by unexpected or unauthorized IAM roles is a high-signal indicator of reconnaissance or exploitation. Organizations should monitor for Client.UnauthorizedOperation errors returned by CloudTrail for this specific API call to identify potential malicious intent by threat actors attempting to discover misconfigured or highly privileged instance credentials.

Impact

Successful exploitation allows an adversary to obtain plaintext administrator credentials for EC2 instances, leading to full compromise of the affected compute resources. This can result in further data exfiltration, movement within the internal VPC, and persistence within the cloud environment. Organizations across all sectors utilizing AWS EC2 are potentially affected if IAM policies are overly permissive.

Recommendation

Detection engineering teams should prioritize identifying anomalous API usage related to instance metadata and credential management.

  • Deploy the provided detection logic to monitor AWS CloudTrail logs for unauthorized GetPasswordData events.
  • Review IAM roles currently holding ec2:GetPasswordData permissions and enforce the principle of least privilege.
  • Establish alerting for Client.UnauthorizedOperation errors on sensitive AWS EC2 APIs to detect persistent reconnaissance attempts.
  • Ensure that CloudTrail logging is enabled and ingested into a centralized SIEM for timely correlation and triage.

Immediate actions

Deploy the Sigma detection rule to monitor CloudTrail for UnauthorizedOperation errors on GetPasswordData.

Detection Engineering 48h

Threat Hunt

Search logs for any occurrence of GetPasswordData by non-standard or highly privileged user roles.

T1552.005 medium high confidence hunt now

Data: AWS CloudTrail logs

Mitigations

Audit and restrict IAM policies containing the ec2:GetPasswordData action.

immediate IT Operations

T1552.005

Detection coverage 5

AWS EC2 Unauthorized Admin Credential Fetch via Assumed Role

medium

Detects unauthorized attempts by an AWS role to use GetPasswordData to access the administrator password of an EC2 instance, indicated by an UnauthorizedOperation error.

sigma tactics: credential_access, privilege_escalation techniques: T1078.004, T1552.005 sources: cloudtrail, aws

AWS EC2 EBS Snapshot Access Removed

medium

Detects when access is removed for an AWS EC2 EBS snapshot, which may indicate an attempt to inhibit system recovery.

sigma tactics: impact techniques: T1490 sources: webserver

Detect Unauthorized AWS Network ACL Creation

low

Detects the creation of an AWS EC2 network access control list (ACL) or an entry in a network ACL by users not identified as known automation tools.

sigma tactics: defense_evasion, persistence techniques: T1562.007 sources: cloudtrail, aws

Detect AWS EC2 Role GetCallerIdentity from New Source AS

medium

Detects the first time an EC2 instance role session calls AWS STS GetCallerIdentity from a source AS organization not seen in the previous 10 days, excluding standard Amazon and Google infrastructure.

sigma tactics: discovery techniques: T1087.004 sources: webserver

AWS SSM Session Started to EC2 Instance

high

Detects the first occurrence of an AWS user or role establishing an SSM session to an EC2 instance, which may indicate lateral movement.

sigma tactics: lateral_movement techniques: T1021.007 sources: webserver

Detection queries are available on the platform. Get full rules →