VPS C2 listener established after AWS Secrets Manager credential theft

Ibrahim Saud@tektrix

•updated 22 days ago•0•0•2

Detects a sequence where an AWS Secrets Manager secret is retrieved via CloudTrail, followed within 30 minutes by an EDR-monitored process initiating an outbound network connection on a non-standard port (not 80 or 443). This behavior is consistent with an adversary using stolen credentials to pivot into a persistent command-and-control channel.