EC2 backdoor created with newly added external SSH or RDP access

Synopsis

Field	Value
Activation Period	14 Days
Training Period	30 Days
Test Period	1 Hour
Deduplication Period	1 Day
Required Data	AWS Audit Log
Detection Modules	Cloud
ATT&CK Tactic	Persistence (TA0003)
ATT&CK Technique	Account Manipulation (T1098)
Severity	High

Description

EC2 instance created with an administrator instance profile and a newly added external SSH or RDP access.

Attacker's Goals

• Create a reliable backdoor as an EC2 instance reachable from the attacker's IP address.
• Persistence relies on logging into the instance to obtain its instance-profile credentials and pivot into the AWS account.
• This requires the instance to be externally reachable over SSH or RDP and to have a public IP address.

Investigative actions

• Identify the instance profile used and which security groups were modified to allow external access.
• Analyze the identity that created the EC2 instance and instance profile, and any other actions it performed.
• Correlate with other suspicious activity from the instance profile or originating from the instance IP.

Variations

EC2 backdoor created with a newly added external SSH or RDP access by a rarely used identity

Synopsis

Field	Value
ATT&CK Tactic	Persistence (TA0003)
ATT&CK Technique	Account Manipulation (T1098)
Severity	High

Description

EC2 instance created with an administrator instance profile and a newly added external SSH or RDP access.

Attacker's Goals

• Create a reliable backdoor as an EC2 instance reachable from the attacker's IP address.
• Persistence relies on logging into the instance to obtain its instance-profile credentials and pivot into the AWS account.
• This requires the instance to be externally reachable over SSH or RDP and to have a public IP address.

Investigative actions

• Identify the instance profile used and which security groups were modified to allow external access.
• Analyze the identity that created the EC2 instance and instance profile, and any other actions it performed.
• Correlate with other suspicious activity from the instance profile or originating from the instance IP.