AWS EC2 password retrieval
Repeated GetPasswordData calls — the API that returns the encrypted local Administrator password for a Windows EC2 instance.
What it detects
Repeated GetPasswordData calls — the API that returns the encrypted local Administrator password for a Windows EC2 instance.
Called once, it is how an operator legitimately retrieves a password after launching an instance. Called across many instances in a short window, it is credential harvesting: an identity with EC2 read rights sweeping the fleet for local administrator passwords to move laterally onto the hosts themselves.
MITRE ATT&CK mapping
False positives and triage
Provisioning tooling that launches Windows instances in batches retrieves each one's password and will legitimately cross this threshold — identify those roles and baseline them. The signal is retrieval by an interactive user rather than an automation principal, retrieval spanning instances the caller does not own or administer, or retrieval with no matching RunInstances shortly before.
The rule
Declarative YAML read by the detection engine — data, never executed. Confidence 60%. Source: rules/cloud/aws_ec2_password_retrieval.yaml, licensed under the Apache License 2.0.
id: cloud.aws.ec2_password_retrieval
version: 1.0.0
status: stable
severity: medium
confidence: 0.6
platforms: [application]
mitre_techniques: [T1552, T1078.004]
description: |
Repeated `GetPasswordData` calls — the API that returns the encrypted local
Administrator password for a Windows EC2 instance.
Called once, it is how an operator legitimately retrieves a password after
launching an instance. Called across many instances in a short window, it is
credential harvesting: an identity with EC2 read rights sweeping the fleet for
local administrator passwords to move laterally onto the hosts themselves.
match:
provider: AWS
event_action: GetPasswordData
threshold:
count: 5
window_seconds: 600
group_by: [user_name]
correlation_keys: [user_name]
false_positive_guidance: |
Provisioning tooling that launches Windows instances in batches retrieves each
one's password and will legitimately cross this threshold — identify those roles
and baseline them. The signal is retrieval by an interactive user rather than an
automation principal, retrieval spanning instances the caller does not own or
administer, or retrieval with no matching `RunInstances` shortly before.
Related detections
Run this rule on your own logs — offline
KIROSEC runs this rule and the rest of the library over Windows, Linux, macOS and cloud audit logs on the analyst's own machine. Every alert links to the events that raised it, and nothing leaves the device.