Unusual AWS systems manager activity

Cortex XDR Analytics Alert Reference by Alert name

Product
Cortex XDR
Last date published
2024-06-04
Category
Analytics Alert Reference
Order
Alert name

Synopsis

Activation Period

14 Days

Training Period

30 Days

Test Period

N/A (single event)

Deduplication Period

1 Day

Required Data

  • Requires:
    • AWS Audit Log

Detection Modules

Cloud

ATT&CK Tactic

Defense Evasion (TA0005)

ATT&CK Technique

Modify Cloud Compute Infrastructure (T1578)

Severity

Informational

Description

A cloud Identity performed an SSM operation for the first time.

Attacker's Goals

Manipulate SSM operations to take control over EC2 instances and strengthen the foothold in the cloud environment of the organization, by running critical operating system commands, manipulating the parameters store, and patch management configuration.

Investigative actions

  • Check the identity's role designation in the organization.
  • Verify that the identity did not perform any sensitive SSM operation that it shouldn't.