Cloud compute serial console access

Cortex XDR Analytics Alert Reference by Alert name

Product

Cortex XDR

Last date published

2024-10-08

Synopsis

Activation Period	14 Days
Training Period	30 Days
Test Period	N/A (single event)
Deduplication Period	5 Days
Required Data	Requires one of the following data sources: AWS Audit Log OR Azure Audit Log OR Gcp Audit Log
Detection Modules	Cloud
Detector Tags
ATT&CK Tactic	Lateral Movement (TA0008)
ATT&CK Technique	Remote Services: Direct Cloud VM Connections (T1021.008)
Severity	Informational

Description

An identity connected to a compute instance using serial console access.
This may indicate an attacker attempting to move laterally between cloud instances.

Attacker's Goals

Utilize direct access to virtual infrastructure to pivot through a cloud environment.

Investigative actions

Verify whether the identity should be making this action.
Investigate which actions were performed via serial console access.

Variations

Suspicious cloud compute serial console access in a project

Synopsis

ATT&CK Tactic	Lateral Movement (TA0008)
ATT&CK Technique	Remote Services: Direct Cloud VM Connections (T1021.008)
Severity	Low

Description

An identity connected to a compute instance using serial console access.
This may indicate an attacker attempting to move laterally between cloud instances.

Attacker's Goals

Utilize direct access to virtual infrastructure to pivot through a cloud environment.

Investigative actions

Verify whether the identity should be making this action.
Investigate which actions were performed via serial console access.