Analytics BIOC
Informational
✕
Serial console access was enabled in AWS account
Serial console access to EC2 instances was enabled in an AWS account.
- Module:
- Cortex Cloud
- Licensed by:
- Cloud Runtime Security (CRS)
- Data source:
- AWS Audit Log
ATT&CK tactics: Lateral Movement (TA0008)
ATT&CK techniques: Remote Services: Direct Cloud VM Connections (T1021.008) Remote Services: Cloud Services (T1021.007)
Attacker's goals:
Utilize direct access to virtual infrastructure to pivot through a cloud environment.
Investigative actions:
Verify whether serial console access should be enabled.* Investigate which actions were performed via serial console access.
- Test period:
- N/A (single event)
- Deduplication:
- 5 Days