AWS SSM Command Document Created by Rare User

Description

Identifies when an AWS Systems Manager (SSM) command document is created by a user or role who does not typically perform this action. Adversaries may create SSM command documents to execute commands on managed instances, potentially leading to unauthorized access, command and control, data exfiltration and more.

Query · kuery

data_stream.dataset: "aws.cloudtrail"
    and event.provider: "ssm.amazonaws.com"
    and event.action: "CreateDocument"
    and event.outcome: "success"
    and aws.cloudtrail.flattened.response_elements.documentDescription.documentType: "Command"

Investigation fields

Pivot points the source recommends for triage.

  • @timestamp
  • user.name
  • user_agent.original
  • source.ip
  • aws.cloudtrail.user_identity.arn
  • aws.cloudtrail.user_identity.type
  • aws.cloudtrail.user_identity.access_key_id
  • event.action
  • event.outcome
  • cloud.account.id
  • cloud.region
  • aws.cloudtrail.request_parameters
  • aws.cloudtrail.response_elements

Known false positives

  • Legitimate users may create SSM command documents for legitimate purposes. Ensure that the document is authorized and the user is known before taking action.

Analyst notes

Investigating AWS SSM Command Document Created by Rare User

This rule identifies when an AWS Systems Manager (SSM) command document is created by a user who does not typically perform this action. Creating SSM command documents can be a legitimate action but may also indicate malicious intent if done by an unusual or compromised user. Adversaries may leverage SSM documents to execute commands on managed instances, potentially leading to unauthorized access, command and control, or data exfiltration.

Possible Investigation Steps

  • Identify the Actor: Review the aws.cloudtrail.user_identity.arn field to identify who created the SSM document. Verify if this user typically creates such documents and has the appropriate permissions. It may be unexpected for certain types of users, like assumed roles or federated users, to perform this action.
  • Analyze the Document Details:
  • Document Name: Check the aws.cloudtrail.request_parameters.name field for the document name to understand its intended purpose.
  • Document Content: If possible, review aws.cloudtrail.request_parameters.content for any sensitive or unexpected instructions (e.g., actions for data exfiltration or privilege escalation). If not available via logs, consider reviewing the document in the AWS Management Console.
  • Contextualize the Activity with Related Events: Look for other CloudTrail events involving the same user ARN or IP address (source.ip). Examine actions performed in other AWS services, such as IAM, EC2, or S3, to identify if additional suspicious behavior exists. The SendCommand API call may indicate attempts to execute the SSM document on managed instances.
  • Check Document Status and Metadata:
  • Document Status: Confirm the document creation status in aws.cloudtrail.response_elements.documentDescription.status. A status of Creating may indicate that the document is in progress.
  • Execution Permissions: Review if the document specifies platformTypes and documentVersion in aws.cloudtrail.response_elements.documentDescription to understand which environments may be impacted and if multiple versions exist.

False Positive Analysis

  • Authorized Administrative Actions: Determine if this document creation aligns with scheduled administrative tasks or actions by authorized personnel.
  • Historical User Actions: Compare this action against historical activities for the user to determine if they have a history of creating similar documents, which may indicate legitimate usage.

Response and Remediation

  • Immediate Document Review and Deletion: If the document creation is deemed unauthorized, delete the document immediately and check for other similar documents created recently.
  • Enhance Monitoring and Alerts: Configure additional monitoring for SSM document creation events, especially when associated with untrusted or rare users.
  • Policy Update: Consider restricting SSM document creation permissions to specific, trusted roles or users to prevent unauthorized document creation.
  • Incident Response: If the document is confirmed as part of malicious activity, treat this as a security incident. Follow incident response protocols, including containment, investigation, and remediation.

Additional Information

For further guidance on managing and securing AWS Systems Manager in your environment, refer to the AWS SSM documentation and AWS security best practices.

Raw source AWS SSM Command Document Created by Rare User · Elastic TOML
Esc
Published by elastic/detection-rules ↗, licensed under Elastic License 2.0 ↗. Reproduced here unmodified. 
[metadata]
creation_date = "2024/11/01"
integration = ["aws"]
maturity = "production"
updated_date = "2026/07/08"

[rule]
author = ["Elastic"]
description = """
Identifies when an AWS Systems Manager (SSM) command document is created by a user or role who does not typically perform this action. Adversaries may create SSM command documents to execute commands on managed instances, potentially leading to unauthorized access, command and control, data exfiltration and more.
"""
false_positives = [
    """
    Legitimate users may create SSM command documents for legitimate purposes. Ensure that the document is authorized and the user is known before taking action.
    """,
]
from = "now-6m"
index = ["filebeat-*", "logs-aws.cloudtrail-*"]
language = "kuery"
license = "Elastic License v2"
name = "AWS SSM Command Document Created by Rare User"
note = """## Triage and analysis

### Investigating AWS SSM Command Document Created by Rare User

This rule identifies when an AWS Systems Manager (SSM) command document is created by a user who does not typically perform this action. Creating SSM command documents can be a legitimate action but may also indicate malicious intent if done by an unusual or compromised user. Adversaries may leverage SSM documents to execute commands on managed instances, potentially leading to unauthorized access, command and control, or data exfiltration.

#### Possible Investigation Steps

- **Identify the Actor**: Review the `aws.cloudtrail.user_identity.arn` field to identify who created the SSM document. Verify if this user typically creates such documents and has the appropriate permissions. It may be unexpected for certain types of users, like assumed roles or federated users, to perform this action.
- **Analyze the Document Details**:
  - **Document Name**: Check the `aws.cloudtrail.request_parameters.name` field for the document name to understand its intended purpose.
  - **Document Content**: If possible, review `aws.cloudtrail.request_parameters.content` for any sensitive or unexpected instructions (e.g., actions for data exfiltration or privilege escalation). If not available via logs, consider reviewing the document in the AWS Management Console.
- **Contextualize the Activity with Related Events**: Look for other CloudTrail events involving the same user ARN or IP address (`source.ip`). Examine actions performed in other AWS services, such as IAM, EC2, or S3, to identify if additional suspicious behavior exists. The `SendCommand` API call may indicate attempts to execute the SSM document on managed instances.
- **Check Document Status and Metadata**:
  - **Document Status**: Confirm the document creation status in `aws.cloudtrail.response_elements.documentDescription.status`. A status of `Creating` may indicate that the document is in progress.
  - **Execution Permissions**: Review if the document specifies `platformTypes` and `documentVersion` in `aws.cloudtrail.response_elements.documentDescription` to understand which environments may be impacted and if multiple versions exist.

### False Positive Analysis

- **Authorized Administrative Actions**: Determine if this document creation aligns with scheduled administrative tasks or actions by authorized personnel.
- **Historical User Actions**: Compare this action against historical activities for the user to determine if they have a history of creating similar documents, which may indicate legitimate usage.

### Response and Remediation

- **Immediate Document Review and Deletion**: If the document creation is deemed unauthorized, delete the document immediately and check for other similar documents created recently.
- **Enhance Monitoring and Alerts**: Configure additional monitoring for SSM document creation events, especially when associated with untrusted or rare users.
- **Policy Update**: Consider restricting SSM document creation permissions to specific, trusted roles or users to prevent unauthorized document creation.
- **Incident Response**: If the document is confirmed as part of malicious activity, treat this as a security incident. Follow incident response protocols, including containment, investigation, and remediation.

### Additional Information

For further guidance on managing and securing AWS Systems Manager in your environment, refer to the [AWS SSM documentation](https://docs.aws.amazon.com/systems-manager/latest/userguide/what-is-systems-manager.html) and AWS security best practices.
"""
references = [
    "https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_CreateDocument.html",
    "https://docs.aws.amazon.com/systems-manager/latest/userguide/documents.html",
]
risk_score = 73
rule_id = "50a2bdea-9876-11ef-89db-f661ea17fbcd"
severity = "high"
tags = [
    "Domain: Cloud",
    "Data Source: AWS",
    "Data Source: Amazon Web Services",
    "Data Source: AWS SSM",
    "Data Source: AWS Systems Manager",
    "Resources: Investigation Guide",
    "Use Case: Threat Detection",
    "Tactic: Execution",
]
timestamp_override = "event.ingested"
type = "new_terms"

query = '''
data_stream.dataset: "aws.cloudtrail"
    and event.provider: "ssm.amazonaws.com"
    and event.action: "CreateDocument"
    and event.outcome: "success"
    and aws.cloudtrail.flattened.response_elements.documentDescription.documentType: "Command"
'''

[rule.investigation_fields]
field_names = [
    "@timestamp",
    "user.name",
    "user_agent.original",
    "source.ip",
    "aws.cloudtrail.user_identity.arn",
    "aws.cloudtrail.user_identity.type",
    "aws.cloudtrail.user_identity.access_key_id",
    "event.action",
    "event.outcome",
    "cloud.account.id",
    "cloud.region",
    "aws.cloudtrail.request_parameters",
    "aws.cloudtrail.response_elements"
]

[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1651"
name = "Cloud Administration Command"
reference = "https://attack.mitre.org/techniques/T1651/"

[rule.threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"

[rule.new_terms]
field = "new_terms_fields"
value = ["cloud.account.id", "user.name"]
[[rule.new_terms.history_window_start]]
field = "history_window_start"
value = "now-10d"

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.