Unusual AWS systems manager activity

Synopsis

Field	Value
Activation Period	14 Days
Training Period	30 Days
Test Period	N/A (single event)
Deduplication Period	1 Day
Required Data	AWS Audit Log
Detection Modules	Cloud
Detector Tags	SSM Remote Management Analytics
ATT&CK Tactic	Discovery (TA0007), Lateral Movement (TA0008)
ATT&CK Technique	Cloud Service Discovery (T1526), Remote Services: Cloud Services (T1021.007)
Severity	Informational

Description

A cloud identity performed an SSM operation for the first time.

Attacker's Goals

Manipulate SSM operations to take control over EC2 instances and strengthen the foothold in the cloud environment of the organization, by running critical operating system commands, manipulating the parameters store, and patch management configuration.

Investigative actions

• Check the identity's role designation in the organization.
• Verify that the identity did not perform any sensitive SSM operation that it shouldn't.