administrators and automated orchestration may legitimately use ec2 instance connect repeatedly during fleet administration, troubleshooting, or ephemeral-access workflows. review the aws identity, source addresses, user agent, target instances, target operating-system users, and whether the activity corresponds to an approved administrative process.

splunk

Techniques

Sample rules

AWS EC2 Multiple SSH Public Keys Uploaded by a Single Identity

source: splunk
technicques:

Description

Detects an AWS identity making 10 or more successful EC2 Instance ConnectSendSSHPublicKey API calls within the configured search interval. EC2 Instance Connect temporarily makes an SSH public key available to an operating-system user on an EC2 instance. A burst of these calls may indicate automated attempts to establish access or move laterally using compromised AWS credentials.

Detection logic

`cloudtrail`
eventSource="ec2-instance-connect.amazonaws.com"
eventName="SendSSHPublicKey"
responseElements.success=true


| stats dc('requestParameters.instanceId') as unique_instances
        dc(eventID) as event_count
        earliest(_time) as firstTime
        latest(_time) as lastTime
        values('requestParameters.instanceId') as targeted_instances
        values('requestParameters.instanceOSUser') as targeted_users
        values(src) as src
        values(user_agent) as user_agent
        values(vendor_region) as vendor_region
  by user_arn


| where event_count >= 10


| eval duration_seconds=lastTime-firstTime


| `security_content_ctime(firstTime)`

| `security_content_ctime(lastTime)`

| `aws_ec2_multiple_ssh_public_keys_uploaded_by_a_single_identity_filter`