Cross-source coverage
T1651 / ATT&CK
Cloud Administration Command
17 rules across 2 sources.
From MITRE ATT&CK 19.2
Adversaries may abuse cloud management services to execute commands within virtual machines. Resources such as AWS Systems Manager, Azure RunCommand, and Runbooks allow users to remotely run scripts in virtual machines by leveraging installed virtual machine agents.
If an adversary gains administrative access to a cloud environment, they may be able to abuse cloud management services to execute commands in the environment’s virtual machines. Additionally, an adversary that compromises a service provider or delegated administrator account may similarly be able to leverage a Trusted Relationship to execute commands in connected virtual machines.
- Tactics
- Execution
- Platforms
- IaaS
- Telemetry
-
AWS:CloudTrailazure:activityazure:vmguest
How MITRE says to detect it DET0545
Detection Strategy for Cloud Administration Command
IaaS Analytic 1502
Monitor for suspicious use of cloud-native administrative command services (e.g., AWS Systems Manager Run Command, Azure RunCommand, GCP OS Config) to execute code inside VMs. Detect anomalies such as commands/scripts executed by unexpected users, execution outside of maintenance windows, or commands initiated by service accounts not normally tied to administration. Correlate cloud control-plane activity logs with host-level execution (process creation, script execution) to validate if commands materialized inside the guest OS.
AWS:CloudTrailSendCommand, StartSession, ExecuteCommand: Unexpected AWS Systems Manager command execution targeting EC2 instancesazure:activityMicrosoft.Compute/virtualMachines/runCommand/action: Abnormal initiation of Azure RunCommand jobs or PowerShell/Bash payloadsazure:vmguestUnexpected execution of cloud agent processes (e.g., WindowsAzureGuestAgent.exe, ssm-agent) followed by arbitrary script or binary execution
elastic/detection-rules
15 rules| Detection | Severity | Format |
|---|---|---|
| AWS SSM Command Document Created by Rare User | High | Elastic TOML |
| AWS EC2 LOLBin Execution via SSM SendCommand | Medium | Elastic TOML |
| AWS SSM `SendCommand` with Run Shell Command Parameters | Medium | Elastic TOML |
| AWS SSM Session Manager Child Process Execution | Medium | Elastic TOML |
| Azure Compute VM Command Executed | Medium | Elastic TOML |
| Azure Run Command Correlated with Process Execution | Medium | Elastic TOML |
| Azure Run Command Script Child Process | Medium | Elastic TOML |
| Azure VM Extension CRUD Operation with Unusual Source ASN | Medium | Elastic TOML |
| Azure VM Extension Deployment by User | Medium | Elastic TOML |
| Azure VM Managed Run Command Created or Updated with Unusual Principal | Medium | Elastic TOML |
+ 5 more from elastic/detection-rules → showing the 10 highest-severity
panther-labs/panther-analysis
2 rules| Detection | Severity | Format |
|---|---|---|
| Azure Serverless Script Execution | Informational | Panther Python |
| Azure VM Command Executed | Informational | Panther Python |