T1021.004: SSH

T1021.004: SSH

Adversaries may use [Valid Accounts](https://attack.mitre.org/techniques/T1078) to log into remote machines using Secure Shell (SSH). The adversary may then perform actions as the logged-on user.

View on MITRE ATT&CK →

GCP google.ssh-serialport.v1.connect

Records a connection to a VM’s interactive serial console.

Cloud Service: GCP - SSH Serial Port

Tactics:

Lateral Movement

Techniques:

T1021.004

Tags:

GCP SSH Serial Port

AWS SendSerialConsoleSSHPublicKey

Publishes an SSH key for a 60-second EC2 serial-console connection window.

Cloud Service: AWS - EC2InstanceConnect

Tactics:

Lateral Movement

Techniques:

T1021.004

Tags:

AWS EC2InstanceConnect

AWS SendSSHPublicKey

Publishes a temporary SSH key through EC2 Instance Connect.

Cloud Service: AWS - EC2InstanceConnect

Tactics:

Lateral Movement

Techniques:

T1021.004

Tags:

AWS EC2InstanceConnect