Skip to content
Threat Feed
Subscribe

Product

EC2 Instances

1 brief RSS
high advisory

AWS EC2 Instance Connect SSH Public Key Upload Detection

Adversaries may upload SSH public keys to AWS EC2 instances via the EC2 Instance Connect service using the `SendSSHPublicKey` or `SendSerialConsoleSSHPublicKey` API actions, which can serve as a mechanism for initial access, persistence, or privilege escalation, particularly if the `SendSerialConsoleSSHPublicKey` action is coupled with unauthorized serial console access.

EC2 Instance Connect +1 cloud aws lateral-movement privilege-escalation persistence
1r 3t