SEKOIA.IO Rules high stable sigma

AWS CloudTrail EC2 Enable Serial Console Access

Detects when the EC2 serial console access feature is enabled. This could abused by some attackers to avoid network detection when accessing to EC2 instances.

View Source

Detection Logic

selection:
  sekoiaio.intake.dialect_uuid: d3a813ac-f9b5-451c-a602-a5994544d9ed
  event.action: EnableSerialConsoleAccess
condition: selection

Field Validations

Loading…

Comments (0)

Loading comments...