Skip to content
Threat Feed
Subscribe

Product

AWS SSM

1 brief RSS
medium advisory

Detection of SDK-Based AWS Control Plane Discovery from Suspicious Processes

This detection monitors for processes executing from temporary or user-writable directories that perform DNS queries to AWS management endpoints, a pattern frequently utilized by post-exploitation tools to bypass CLI-based security controls.

AWS IAM +5 cloud-security discovery aws credential-theft detection-engineering
2t