Detecting Suspicious AWS EC2 Instance Connect SSH Key Injection

This threat involves the abuse of the AWS EC2 Instance Connect service, specifically the SendSSHPublicKey API call. Attackers with compromised AWS credentials can use this API to temporarily push an SSH public key to an EC2 instance, granting them shell access to an operating system user without requiring long-term persistent keys. Security teams should monitor for anomalous bursts of these API calls originating from a single identity, which may signal automated lateral movement, unauthorized fleet access, or persistent probing by an attacker. Defenders should baseline expected administrative usage, as orchestration tools and automated patching workflows may trigger similar patterns.

Impact

Successful exploitation allows an attacker to gain unauthorized remote access to EC2 instances, facilitating data exfiltration, lateral movement within the VPC, or the deployment of additional malicious tools. The primary concern is the rapid, automated nature of this technique which allows an attacker to compromise multiple targets simultaneously using a single set of compromised credentials.

Recommendation

• Deploy detection logic to monitor AWS CloudTrail for a high volume of SendSSHPublicKey events from a single identity.
• Establish an allowlist for known administrative or automated deployment identities that perform legitimate fleet management.
• Audit permissions to ensure that IAM identities are restricted to only the necessary EC2 instances using condition keys (e.g., ec2:InstanceIdentifier).
• Investigate the src IP and user_agent associated with alerted identities to differentiate between automated management tools and unauthorized activity.