Skip to content
Threat Feed
Subscribe

Product

AWS EC2 Instance Connect

1 brief RSS
medium advisory

Detecting Suspicious AWS EC2 Instance Connect SSH Key Injection

An AWS identity performing a high volume of SendSSHPublicKey API calls may indicate automated lateral movement or unauthorized access attempts via EC2 Instance Connect.

AWS EC2 Instance Connect lateral-movement cloud aws cloudtrail
1r 2t