AWS EC2 Get Windows Admin Password Retrieval

Google SecOps@GoogleSecOps

•updated Jan 30, 2025•0•48

Detects a successful attempt to retrieve the encrypted Administrator password for a Windows EC2 instance using the GetPasswordData API call in AWS CloudTrail. This action indicates an adversary is attempting to gain access to credentials for a Windows virtual machine.