All Detections

AWS EC2 GetPasswordData API Call

avatar
Lacey Cochrane@NullVectorX
updated Mar 18, 202620124

Detects when the AWS EC2 GetPasswordData API call is made. This API call retrieves the Windows administrator password for an EC2 instance, which could indicate an attempt to gain unauthorized access to an instance.

Cortex XDR