{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/aws-ec2-instance-connect/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["AWS EC2 Instance Connect"],"_cs_severities":["medium"],"_cs_tags":["lateral-movement","cloud","aws","cloudtrail"],"_cs_type":"advisory","_cs_vendors":["Amazon"],"content_html":"\u003cp\u003eThis threat involves the abuse of the AWS EC2 Instance Connect service, specifically the \u003ccode\u003eSendSSHPublicKey\u003c/code\u003e API call. Attackers with compromised AWS credentials can use this API to temporarily push an SSH public key to an EC2 instance, granting them shell access to an operating system user without requiring long-term persistent keys. Security teams should monitor for anomalous bursts of these API calls originating from a single identity, which may signal automated lateral movement, unauthorized fleet access, or persistent probing by an attacker. Defenders should baseline expected administrative usage, as orchestration tools and automated patching workflows may trigger similar patterns.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows an attacker to gain unauthorized remote access to EC2 instances, facilitating data exfiltration, lateral movement within the VPC, or the deployment of additional malicious tools. The primary concern is the rapid, automated nature of this technique which allows an attacker to compromise multiple targets simultaneously using a single set of compromised credentials.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eDeploy detection logic to monitor AWS CloudTrail for a high volume of \u003ccode\u003eSendSSHPublicKey\u003c/code\u003e events from a single identity.\u003c/li\u003e\n\u003cli\u003eEstablish an allowlist for known administrative or automated deployment identities that perform legitimate fleet management.\u003c/li\u003e\n\u003cli\u003eAudit permissions to ensure that IAM identities are restricted to only the necessary EC2 instances using condition keys (e.g., \u003ccode\u003eec2:InstanceIdentifier\u003c/code\u003e).\u003c/li\u003e\n\u003cli\u003eInvestigate the \u003ccode\u003esrc\u003c/code\u003e IP and \u003ccode\u003euser_agent\u003c/code\u003e associated with alerted identities to differentiate between automated management tools and unauthorized activity.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-19T02:50:59Z","date_published":"2026-10-19T02:50:59Z","id":"https://feed.craftedsignal.io/briefs/2026-10-aws-ec2-ssh-key-abuse/","summary":"An AWS identity performing a high volume of SendSSHPublicKey API calls may indicate automated lateral movement or unauthorized access attempts via EC2 Instance Connect.","title":"Detecting Suspicious AWS EC2 Instance Connect SSH Key Injection","url":"https://feed.craftedsignal.io/briefs/2026-10-aws-ec2-ssh-key-abuse/"}],"language":"en","title":"CraftedSignal Threat Feed - AWS EC2 Instance Connect","version":"https://jsonfeed.org/version/1.1"}