Detects an AWS identity making 10 or more successful EC2 Instance ConnectSendSSHPublicKey API calls within a configured search interval. EC2 Instance Connect temporarily exposes an SSH public key to an OS user on an EC2 instance. A burst of these calls may indicate automated attempts to establish access or move laterally using compromised AWS credentials. The SPL search relies on AWS CloudTrail data (eventSource ec2-instance-connect.amazonaws.com and eventName SendSSHPublicKey with responseElements.success=true) and aggregates results by user_arn to identify the number of unique target instances and the total event count. It records first and last seen times, targeted instances and users, source IPs, user agents, and region. When event_count >= 10, the query computes duration and formats timestamps for threat visualization, producing a finding that highlights the AWS identity responsible and the number of SSH public keys uploaded. The rule leverages a built-in time formatter (security_content_ctime) and a corresponding filter macro to enforce the threshold. It is designed for Splunk deployments with the Splunk AWS Add-on and CloudTrail logs enabled. If triggered, it contributes to threat detection around credential abuse and potential lateral movement via SSH. False positives include legitimate fleet administration or automation that legitimately uploads multiple SSH keys during workflow troubleshooting, so analysts should review identity, source, target instances, user agent, and alignment with approved processes.