SendSerialConsoleSSHPublicKey
AWS
SendSerialConsoleSSHPublicKey
Event
Pushes an SSH public key to an EC2 instance’s serial console interface, enabling SSH access over the serial port.
Security Context
- Creating long-lived access keys or credentials provides persistent access that survives password resets and session revocations.
- Execution capabilities in cloud services can be abused to run malicious code, establish C2 channels, or perform reconnaissance.
- SSH-based lateral movement provides adversaries with interactive command-line access to other compute instances in the environment.
Log Source
CloudTrail
Sample Event
Adversarial. Draco pushes a 60-second SSH public key to the serial port (port 0) of i-0phoenix000000010 — a PHOENIX backup-orchestration host. Serial console access can bypass network ACLs that would block SSH on port 22 because it’s a control-plane channel. He uses ec2-serial-console.us-east-1.amazonaws.com as the eventual SSH target (the AWS endpoint that proxies serial console traffic). T1098.004 (SSH authorized-keys account manipulation) + T1021.004 (SSH lateral movement).
{ "eventVersion": "1.09", "userIdentity": { "type": "IAMUser", "principalId": "AIDADRAC0MALF0YBADGY", "arn": "arn:aws:iam::555123456789:user/draco", "accountId": "555123456789", "accessKeyId": "AKIADRAC0MALF0YEXAMP5", "userName": "draco", "sessionContext": { "attributes": { "creationDate": "2026-04-15T18:51:02Z", "mfaAuthenticated": "false" } } }, "eventTime": "2026-04-15T20:21:50Z", "eventSource": "ec2-instance-connect.amazonaws.com", "eventName": "SendSerialConsoleSSHPublicKey", "awsRegion": "us-east-1", "sourceIPAddress": "203.0.113.66", "userAgent": "aws-cli/1.18.147 Python/3.7.10 Linux/5.4.0-1045-aws botocore/1.18.6", "requestParameters": { "instanceId": "i-0phoenix000000010", "serialPort": 0, "sSHPublicKey": "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEdracoExfilKey203011366FantasticLogsExampleAAAAA draco@malfoy-manor" }, "responseElements": { "requestId": "90000000-0000-4000-8000-000110101000", "success": true }, "requestID": "90000000-0000-4000-8000-000110101000", "eventID": "90000000-0000-4000-8000-000110101001", "readOnly": false, "eventType": "AwsApiCall", "managementEvent": true, "recipientAccountId": "555123456789", "eventCategory": "Management", "tlsDetails": { "tlsVersion": "TLSv1.3", "cipherSuite": "TLS_AES_128_GCM_SHA256", "clientProvidedHostHeader": "ec2-instance-connect.us-east-1.amazonaws.com" }}MITRE ATT&CK Mapping
Tactics: Lateral Movement Execution
Techniques:
- T1098.004 — SSH Authorized Keys — Adversaries may modify the SSH <code>authorized_keys</code> file to maintain persistence on a victim host. Linux distributions, macOS, and ESXi hypervisors commonly use key-based authentication to secure the authentication process of SSH sessions for remote management. The <code>authorized_keys</...
- T1021.004 — SSH — Adversaries may use [Valid Accounts](https://attack.mitre.org/techniques/T1078) to log into remote machines using Secure Shell (SSH). The adversary may then perform actions as the logged-on user.