Unusual process executed by AWS Systems Manager

Synopsis

Field	Value
Activation Period	14 Days
Training Period	30 Days
Test Period	N/A (single event)
Deduplication Period	1 Day
Required Data	XDR Agent
Detection Modules	Cloud
Detector Tags	SSM Remote Management Analytics
ATT&CK Tactic	Execution (TA0002)
ATT&CK Technique	Command and Scripting Interpreter (T1059)
Severity	Medium

Description

An unusual process was executed by the AWS Systems Manager agent. Adversaries may use the Systems Manager agent to execute malicious commands on an endpoint.

Attacker's Goals

Adversaries may execute malicious code using legitimate cloud administration tools.

Investigative actions

Verify if this is a legitimate script or command being run by an administrator using AWS Systems Manager.