AWS EC2 Multiple SSH Public Keys Uploaded by a Single Identity — Detection Rule
Detects an AWS identity making 10 or more successful EC2 Instance ConnectSendSSHPublicKey API calls within the configured search interval. EC2 Instance Connect temporarily makes an SSH public key available to an operating-system user on an EC2 instance. A burst of these calls may indicate automated attempts to establish access or move laterally using compromised AWS credentials.