attack.t1078.002 | Detection.FYI

Malicious Usage Of IMDS Credentials Outside Of AWS Infrastructure

Jun 2, 2025 · attack.privilege-escalation attack.defense-evasion attack.t1078 attack.t1078.002 ·
Share on:

Detects when an instance identity has taken an action that isn't inside SSM. This can indicate that a compromised EC2 instance is being used as a pivot point.

Read More
Admin User Remote Logon

May 20, 2025 · attack.lateral-movement attack.initial-access attack.t1078.001 attack.t1078.002 attack.t1078.003 car.2016-04-005 ·
Share on:

Detect remote login by Administrator user (depending on internal pattern).

Read More