EC2 Password Data Retrieved

Status: test
Severity: low
Log source: product aws, service cloudtrail
Author: Zach Mathis (@yamatosecurity)
Source: github.com/Yamato-Security/suzaku-rules

Detects retrieval or attempted retrieval of EC2 password data, which may indicate an attacker gaining access to an instance's password.

MITRE ATT&CK coverage

Tactic	Techniques
Credential Access	`T1555` Credentials from Password Stores

Telemetry coverage

Platform	Record / event type
AWS	CloudTrail event `GetPasswordData`: Retrieves the encrypted administrator password for a Windows instance.

Rules detecting the same action

These rules filter on the same operation.

AWS Credential Access GetPasswordData (Splunk)
AWS EC2 Many Password Read Attempts (Panther)
AWS EC2 Unauthorized Admin Credential Fetch via Assumed Role (Elastic)

Rule body

title: EC2 Password Data Retrieved
id: dca4edde-477d-46d9-a2ec-5eb2117bbaa0
status: test
description: Detects retrieval or attempted retrieval of EC2 password data, which may indicate an attacker gaining access to an instance's password.
references:
author: Zach Mathis (@yamatosecurity)
date: 2025-08-02
modified: 2025-08-02
tags:
    - attack.credential_access
    - attack.t1555 # Credentials from Password Stores
logsource:
    product: aws
    service: cloudtrail
detection:
    selection:
        eventSource: ec2.amazonaws.com
        eventName: 'GetPasswordData'
    condition: selection
level: low

Stages and Predicates

Stage 0: `condition`

selection

Stage 1: `selection`

selection:
    eventSource: ec2.amazonaws.com
    eventName: 'GetPasswordData'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`eventName`	eq	`GetPasswordData`	`field:"aws::eventName" kind:eq value:"GetPasswordData"`
`eventSource`	eq	`ec2.amazonaws.com`	`field:"aws::eventSource" kind:eq value:"ec2.amazonaws.com"`