Cloud compute serial console access

Synopsis

Field	Value
Activation Period	14 Days
Training Period	30 Days
Test Period	N/A (single event)
Deduplication Period	5 Days
Required Data	Requires one of the following data sources: AWS Audit Log OR Azure Audit Log OR Gcp Audit Log
Detection Modules	Cloud
ATT&CK Tactic	Lateral Movement (TA0008)
ATT&CK Technique	Remote Services: Direct Cloud VM Connections (T1021.008), Remote Services: Cloud Services (T1021.007)
Severity	Informational

Description

An identity connected to a compute instance using serial console access. This may indicate an attacker attempting to move laterally between cloud instances.

Attacker's Goals

• Utilize direct access to virtual infrastructure to pivot through a cloud environment.

Investigative actions

• Verify whether the identity should be making this action.
• Investigate which actions were performed via serial console access.

Variations

Cloud compute serial console access by an identity with high administrative activity

Synopsis

Field	Value
ATT&CK Tactic	Lateral Movement (TA0008)
ATT&CK Technique	Remote Services: Direct Cloud VM Connections (T1021.008), Remote Services: Cloud Services (T1021.007)
Severity	Informational

Description

An identity with high administrative activity connected to a compute instance using serial console access. This may indicate an attacker attempting to move laterally between cloud instances.

Attacker's Goals

• Utilize direct access to virtual infrastructure to pivot through a cloud environment.

Investigative actions

• Verify whether the identity should be making this action.
• Investigate which actions were performed via serial console access.

Suspicious cloud compute serial console access in a project

Synopsis

Field	Value
ATT&CK Tactic	Lateral Movement (TA0008)
ATT&CK Technique	Remote Services: Direct Cloud VM Connections (T1021.008), Remote Services: Cloud Services (T1021.007)
Severity	Low

Description

An identity connected to a compute instance using serial console access. This may indicate an attacker attempting to move laterally between cloud instances.

Attacker's Goals

• Utilize direct access to virtual infrastructure to pivot through a cloud environment.

Investigative actions

• Verify whether the identity should be making this action.
• Investigate which actions were performed via serial console access.