Encrypted administrator password retrieved for Windows EC2 instance

문서 > Datadog 보안 > OOTB Rules > Encrypted administrator password retrieved for Windows EC2 instance

Classification:

attack

Tactic:

TA0006-credential-access

Technique:

T1555-credentials-from-password-stores

이 페이지는 아직 한국어로 제공되지 않으며 번역 작업 중입니다. 번역에 관한 질문이나 의견이 있으시면 언제든지 저희에게 연락해 주십시오.

Goal

Detect a user attempting to retrieve the encrypted Administrator password for a Windows EC2 instance.

Strategy

This rule allows you to monitor CloudTrail and detect if an attacker has attempted to retrieve the encrypted Administrator password for a Windows EC2 instance using the GetPasswordData API call.

Triage and response

Determine if {{@userIdentity.session_name}} should have made a {{@evt.name}} API call.
If the API call was not made by the user:

Rotate user credentials.
Determine what other API calls were made by the user.

If the API call was made by the user:

Determine if this user should be accessing this EC2 instance.
If Yes, advise the user to speak with the instance owner to resolve the error.
If No, see if other API calls were made by the user and determine if they warrant further investigation.