Elastic medium stable kql

AWS EC2 Unauthorized Admin Credential Fetch via Assumed Role

Identifies the first occurrence of an unauthorized attempt by an AWS role to use `GetPassword` to access the administrator password of an EC2 instance. Adversaries may use this API call to escalate privileges or move laterally within EC2 instances.

View Source

Detection Logic

data_stream.dataset:"aws.cloudtrail"
    and event.provider:"ec2.amazonaws.com" and event.action:"GetPasswordData"
    and aws.cloudtrail.user_identity.type:"AssumedRole" and aws.cloudtrail.error_code:"Client.UnauthorizedOperation"

Field Validations

Loading…

Comments (0)

Loading comments...