detection.wiki

EC2 Instance Connect

eventNameDescriptionSampleRule
anyCatch-all entry for EC2 Instance Connect rules that match the service but not a specific eventName.NN
SendSerialConsoleSSHPublicKeyPushes an SSH public key to the specified EC2 instance to allow SSH access over the instance's serial console port.NY
SendSSHPublicKeyPushes an SSH public key to the specified EC2 instance so it is available for a short period for SSH authentication.YY

any: EC2 Instance Connect (catch-all)

#
Service
ec2-instance-connect

Description

Catch-all entry for EC2 Instance Connect rules that match the service but not a specific eventName.

SendSerialConsoleSSHPublicKey

#
Service
ec2-instance-connect

Description

Pushes an SSH public key to the specified EC2 instance to allow SSH access over the instance's serial console port.

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Elastic #

  • AWS EC2 Instance Connect SSH Public Key Uploaded source high: Identifies when a new SSH public key is uploaded to an AWS EC2 instance using the EC2 Instance Connect service. This action could indicate an adversary attempting to maintain access to the instance. The rule detects the SendSerialConsoleSSHPublicKey or SendSSHPublicKey API actions, which are logged when manually uploading an SSH key to an EC2 instance or serial connection. It is important to know that this API call happens automatically by the EC2 Instance Connect service when a user connects to an EC2 instance using the EC2 Instance Connect service via the CLI or AWS Management Console.T1021, T1021.004, T1098, T1098.004↳ also matches SendSSHPublicKey

SendSSHPublicKey

#
Service
ec2-instance-connect

Description

Pushes an SSH public key to the specified EC2 instance so it is available for a short period for SSH authentication.

Example CloudTrail Event #

{
  "eventVersion": "1.11",
  "userIdentity": {
    "type": "Root",
    "principalId": "123456789012",
    "arn": "arn:aws:iam::123456789012:root",
    "accountId": "123456789012",
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE"
  },
  "eventTime": "2026-07-28T20:58:12Z",
  "eventSource": "ec2-instance-connect.amazonaws.com",
  "eventName": "SendSSHPublicKey",
  "awsRegion": "us-west-1",
  "sourceIPAddress": "203.0.113.5",
  "userAgent": "aws-cli/2.34.28 md/awscrt#0.31.2 ua/2.1 os/linux#6.1.0-51-amd64 md/arch#x86_64 lang/python#3.14.3 md/pyimpl#CPython m/Z,E,n,b cfg/retry-mode#standard md/installer#exe md/distrib#debian.12 md/prompt#off md/command#ec2-instance-connect.send-ssh-public-key",
  "errorCode": "EC2InstanceNotFoundException",
  "errorMessage": "Instance not found.",
  "requestParameters": {
    "instanceId": "i-00000000000000000",
    "instanceOSUser": "dw-harn-eb7866",
    "sSHPublicKey": "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKXvZpvPoHPZlDzK0V8U6Bf0BAM4SsPX8iUu5V5y1g4t dw-harn-eb7866",
    "availabilityZone": "us-west-1a"
  },
  "responseElements": null,
  "requestID": "6aba5ce2-0fca-484c-8041-11170707134c",
  "eventID": "14fb32e9-9f7c-4b2f-b544-adc9cb0cb1a1",
  "readOnly": false,
  "eventType": "AwsApiCall",
  "managementEvent": true,
  "recipientAccountId": "123456789012",
  "eventCategory": "Management",
  "tlsDetails": {
    "tlsVersion": "TLSv1.3",
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "ec2-instance-connect.us-west-1.amazonaws.com"
  }
}

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Elastic #

  • AWS EC2 Instance Connect SSH Public Key Uploaded source high: Identifies when a new SSH public key is uploaded to an AWS EC2 instance using the EC2 Instance Connect service. This action could indicate an adversary attempting to maintain access to the instance. The rule detects the SendSerialConsoleSSHPublicKey or SendSSHPublicKey API actions, which are logged when manually uploading an SSH key to an EC2 instance or serial connection. It is important to know that this API call happens automatically by the EC2 Instance Connect service when a user connects to an EC2 instance using the EC2 Instance Connect service via the CLI or AWS Management Console.T1021, T1021.004, T1098, T1098.004↳ also matches SendSerialConsoleSSHPublicKey

Panther #