Detection: AWS EC2 Multiple SSH Public Keys Uploaded by a Single Identity

Created: 2026-09-29 Last Updated: 2026-09-29 ID: 62afb4a9-d9d0-464a-9326-aacf61c5a9f2 Author: Maria Jose Erquiaga, Splunk Type: TTP Product: Splunk Enterprise Security

Description

Detects an AWS identity making 10 or more successful EC2 Instance ConnectSendSSHPublicKey API calls within the configured search interval. EC2 Instance Connect temporarily makes an SSH public key available to an operating-system user on an EC2 instance. A burst of these calls may indicate automated attempts to establish access or move laterally using compromised AWS credentials.

Search

 1`cloudtrail`
 2eventSource="ec2-instance-connect.amazonaws.com"
 3eventName="SendSSHPublicKey"
 4responseElements.success=true
 5
 6
 7| stats dc('requestParameters.instanceId') as unique_instances
 8        dc(eventID) as event_count
 9        earliest(_time) as firstTime
10        latest(_time) as lastTime
11        values('requestParameters.instanceId') as targeted_instances
12        values('requestParameters.instanceOSUser') as targeted_users
13        values(src) as src
14        values(user_agent) as user_agent
15        values(vendor_region) as vendor_region
16  by user_arn
17
18
19| where event_count >= 10
20
21
22| eval duration_seconds=lastTime-firstTime
23
24
25| `security_content_ctime(firstTime)`
26
27| `security_content_ctime(lastTime)`
28
29| `aws_ec2_multiple_ssh_public_keys_uploaded_by_a_single_identity_filter`

Data Source

Name	Platform	Sourcetype	Source
AWS CloudTrail	AWS	`'aws:cloudtrail'`	`'aws_cloudtrail'`

Macros Used

Name	Value
security_content_ctime	`convert timeformat="%Y-%m-%dT%H:%M:%S" ctime($field$)`
aws_ec2_multiple_ssh_public_keys_uploaded_by_a_single_identity_filter	`search *`

aws_ec2_multiple_ssh_public_keys_uploaded_by_a_single_identity_filter is an empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.

Annotations

- MITRE ATT&CK

+ Kill Chain Phases

+ NIST

+ CIS

- Threat Actors

ID	Technique	Tactic
T1021.004	SSH	Lateral Movement
T1021.008	Direct Cloud VM Connections	Lateral Movement

Exploitation

DE.CM

CIS 10

Default Configuration

This detection is configured by default in Splunk Enterprise Security to run with the following settings:

Setting	Value
Disabled	true
Cron Schedule	`0 * * * *`
Earliest Time	`-70m@m`
Latest Time	`-10m@m`
Schedule Window	`auto`
Creates Finding (Notable)	Yes
Rule Title	`%name%`
Rule Description	`%description%`
Notable Event Fields	user, dest
Creates Intermediate Finding (Risk Event)	No

TTP detections generate a Finding (Notable) and may generate Intermediate Findings (Risk Events) for associated entities.

Implementation

You must install Splunk AWS Add on and enable CloudTrail logs in your AWS Environment.

Known False Positives

Administrators and automated orchestration may legitimately use EC2 Instance Connect repeatedly during fleet administration, troubleshooting, or ephemeral-access workflows. Review the AWS identity, source addresses, user agent, target instances, target operating-system users, and whether the activity corresponds to an approved administrative process.

Associated Analytic Story

Suspicious Cloud Instance Activities

Finding

Title	Entity Field	Entity Type	Risk Score
The AWS identity [$user_arn$] uploaded [$event_count$] SSH public keys using EC2 Instance Connect	user_arn	user	50

Threat Objects

Field	Type
src	ip_address

References

Detection Testing

Test Type	Status	Dataset	Source	Sourcetype
Validation	✅ Passing	N/A	N/A	N/A
Unit	✅ Passing	Dataset	`aws_cloudtrail`	`aws:cloudtrail`
Integration	✅ Passing	Dataset	`aws_cloudtrail`	`aws:cloudtrail`

Replay any dataset to Splunk Enterprise by using our replay.py tool or the UI. Alternatively you can replay a dataset into a Splunk Attack Range

Source: GitHub |

Version: 1