Tag
AWS EC2 Role GetCallerIdentity from New Source AS Organization
2 rules 1 TTPThe rule detects when an EC2 instance role session calls AWS STS GetCallerIdentity from a new source autonomous system (AS) organization name, indicating potential credential theft and verification from outside expected egress paths.
AWS EC2 LOLBin Execution via SSM SendCommand
2 rules 2 TTPsDetection of Living Off the Land Binaries (LOLBins) or GTFOBins execution on EC2 instances via AWS Systems Manager (SSM) SendCommand API, potentially indicating malicious activity.
Suspicious AWS EC2 Key Pair Import Activity
2 rules 1 TTPThe import of SSH key pairs into AWS EC2, as detected by CloudTrail logs, may indicate unauthorized access attempts, persistence establishment, or privilege escalation by an attacker.
Suspicious AWS EC2 Key Pair Creation from Non-Cloud AS
2 rules 3 TTPsAn AWS EC2 CreateKeyPair event triggered by a new principal originating from a network autonomous system (AS) organization not associated with major cloud providers, indicating potential unauthorized access or persistence activity.
AWS EC2 Stop, Start, and User Data Modification Correlation
3 rules 2 TTPsDetection of a sequence of AWS EC2 management API calls indicative of malicious modification of instance user data to execute arbitrary code upon instance restart, potentially leading to privilege escalation and persistence.