Aws ec2 multiple ssh public keys uploaded

[themaryjo]

Summary

Adds a sanitized AWS CloudTrail dataset containing a burst of successful EC2 Instance Connect SendSSHPublicKey API calls. The dataset supports the development and validation of detections for multiple ephemeral SSH public-key uploads performed by a single AWS identity within a short period.

Dataset details

• Events: 12 successful SendSSHPublicKey calls
• Event source: ec2-instance-connect.amazonaws.com
• Format: Newline-delimited JSON
• Interval: Approximately 14 seconds
• Source: AWS CloudTrail
• Sourcetype: aws:cloudtrail
• Target instances: 1 unique EC2 instance

ATT&CK mapping

T1021.004 — Remote Services: SSH
T1021.008 — Remote Services: Direct Cloud VM Connections

Sanitization

Sensitive values were replaced with synthetic values, including:

• AWS account and identity information
• AWS access key ID
• AWS region and availability zone
• EC2 instance ID
• Network source address
• SSH public-key material
• TLS key-exchange value

Validation performed

• Confirmed all 12 records are valid JSON
• Confirmed all 12 CloudTrail eventID values are unique
• Confirmed all 12 events have responseElements.success=true
• Confirmed the dataset contains one unique target instance
• Confirmed targeted sensitive values were replaced
• Confirmed the JSON file is managed through Git LFS

Files added

datasets/attack_techniques/T1021.008/aws_ec2_multiple_ssh_public_keys_uploaded/aws_ec2_multiple_ssh_public_keys_uploaded.json
datasets/attack_techniques/T1021.008/aws_ec2_multiple_ssh_public_keys_uploaded/aws_ec2_multiple_ssh_public_keys_uploaded.yml

[github-actions]

✅ Attack Data Validation Passed

All YAML files in this PR have been successfully validated against the schema.

Ready for review and merge! 🚀