Skip to content
Threat Feed

Tag

Lateral_movement

2 briefs RSS
medium advisory

Suspicious AWS EC2 Key Pair Creation from Non-Cloud AS

An AWS EC2 CreateKeyPair event triggered by a new principal originating from a network autonomous system (AS) organization not associated with major cloud providers, indicating potential unauthorized access or persistence activity.

Amazon EC2 aws ec2 keypair persistence credential_access lateral_movement
2r 3t
high advisory

Suspicious PowerShell Reconnaissance via WMI Queries

Detection of suspicious PowerShell activity using Windows Management Instrumentation (WMI) to gather system information, indicative of reconnaissance efforts by adversaries potentially leading to further exploitation or lateral movement.

Splunk Enterprise +2 powershell wmi reconnaissance lateral_movement windows
2r 2t