An identity started an AWS SSM session

Cortex XDR Analytics Alert Reference by Alert name

Product

Cortex XDR

Last date published

2024-10-08

Activation Period	14 Days
Training Period	30 Days
Test Period	N/A (single event)
Deduplication Period	3 Days
Required Data	Requires: AWS Audit Log
Detection Modules	Cloud
Detector Tags	Cloud Lateral Movement Analytics
ATT&CK Tactic	Lateral Movement (TA0008)
ATT&CK Technique	Remote Services: Direct Cloud VM Connections (T1021.008)
Severity	Informational

AWS SSM interactive session.

Gaining unauthorized access, executing unauthorized commands, or compromising sensitive information within the target system.

Examine the specifics of the SSM session, including the source IP address, identity, and timestamp.
Validate the permissions and roles associated with the user initiating the SSM session to ensure they align with the expected level of access.
Follow further actions taken by the identity or on the relevant instance.

ATT&CK Tactic	Lateral Movement (TA0008)
ATT&CK Technique	Remote Services: Direct Cloud VM Connections (T1021.008)
Severity	Medium

AWS SSM interactive session.

Gaining unauthorized access, executing unauthorized commands, or compromising sensitive information within the target system.

Examine the specifics of the SSM session, including the source IP address, identity, and timestamp.
Validate the permissions and roles associated with the user initiating the SSM session to ensure they align with the expected level of access.
Follow further actions taken by the identity or on the relevant instance.

ATT&CK Tactic	Lateral Movement (TA0008)
ATT&CK Technique	Remote Services: Direct Cloud VM Connections (T1021.008)
Severity	Low

AWS SSM interactive session.

Gaining unauthorized access, executing unauthorized commands, or compromising sensitive information within the target system.

Examine the specifics of the SSM session, including the source IP address, identity, and timestamp.
Validate the permissions and roles associated with the user initiating the SSM session to ensure they align with the expected level of access.
Follow further actions taken by the identity or on the relevant instance.