AWS SSM send command attempt

Cortex XDR Analytics Alert Reference by Alert name

Product

Cortex XDR

Last date published

2024-10-08

Activation Period	14 Days
Training Period	30 Days
Test Period	N/A (single event)
Deduplication Period	3 Days
Required Data	Requires: AWS Audit Log
Detection Modules	Cloud
Detector Tags	Cloud Lateral Movement Analytics
ATT&CK Tactic	Lateral Movement (TA0008) Execution (TA0002)
ATT&CK Technique	Remote Services: Direct Cloud VM Connections (T1021.008) Cloud Administration Command (T1651)
Severity	Informational

An identity executed an AWS SSM Document.

Gaining unauthorized access, executing unauthorized commands, or compromising sensitive information within the target system.

Examine the code in the SSM document, and the target objects.
Validate the permissions and roles associated with the user initiating the SSM session to ensure they align with the expected level of access.
Follow further actions taken by the identity or on the relevant targets.

ATT&CK Tactic

ATT&CK Technique

Severity

Low

An identity executed an AWS SSM Document.

Gaining unauthorized access, executing unauthorized commands, or compromising sensitive information within the target system.

Examine the code in the SSM document, and the target objects.
Validate the permissions and roles associated with the user initiating the SSM session to ensure they align with the expected level of access.
Follow further actions taken by the identity or on the relevant targets.