Analytics BIOC Informational

Serial console access was enabled in AWS account

Serial console access to EC2 instances was enabled in an AWS account.

Module:
Cortex Cloud
Licensed by:
Cloud Runtime Security (CRS)
Data source:
AWS Audit Log
ATT&CK tactics: Lateral Movement (TA0008)
ATT&CK techniques: Remote Services: Direct Cloud VM Connections (T1021.008) Remote Services: Cloud Services (T1021.007)
Attacker's goals:

Utilize direct access to virtual infrastructure to pivot through a cloud environment.

Investigative actions:

Verify whether serial console access should be enabled.* Investigate which actions were performed via serial console access.

Test period:
N/A (single event)
Deduplication:
5 Days