Serial console access was enabled in AWS account

Synopsis

Field	Value
Activation Period	14 Days
Training Period	30 Days
Test Period	N/A (single event)
Deduplication Period	5 Days
Required Data	AWS Audit Log
Detection Modules	Cloud
ATT&CK Tactic	Lateral Movement (TA0008)
ATT&CK Technique	Remote Services: Direct Cloud VM Connections (T1021.008), Remote Services: Cloud Services (T1021.007)
Severity	Informational

Description

Serial console access to EC2 instances was enabled in an AWS account.

Attacker's Goals

• Utilize direct access to virtual infrastructure to pivot through a cloud environment.

Investigative actions

• Verify whether serial console access should be enabled.* Investigate which actions were performed via serial console access.