SSM Session Started to EC2 Instance

Identifies the first occurrence of an AWS resource establishing a session via SSM to an EC2 instance. Adversaries may use AWS Systems Manager to establish a session to an EC2 instance to execute commands on the instance. This can be used to gain access to the instance and perform actions such as privilege escalation. This rule helps detect the first occurrence of this activity for a given AWS resource.

Elastic rule (View on GitHub)

  1[metadata]
  2creation_date = "2024/04/16"
  3integration = ["aws"]
  4maturity = "production"
  5min_stack_comments = "AWS integration breaking changes, bumping version to ^2.0.0"
  6min_stack_version = "8.9.0"
  7updated_date = "2024/05/14"
  8
  9[rule]
 10author = ["Elastic"]
 11description = """
 12Identifies the first occurrence of an AWS resource establishing a session via SSM to an EC2 instance. Adversaries may
 13use AWS Systems Manager to establish a session to an EC2 instance to execute commands on the instance. This can be used
 14to gain access to the instance and perform actions such as privilege escalation. This rule helps detect the first
 15occurrence of this activity for a given AWS resource.
 16"""
 17false_positives = ["Legitimate use of AWS Systems Manager to establish a session to an EC2 instance."]
 18from = "now-60m"
 19index = ["filebeat-*", "logs-aws.cloudtrail-*"]
 20interval = "10m"
 21language = "kuery"
 22license = "Elastic License v2"
 23name = "SSM Session Started to EC2 Instance"
 24note = """## Triage and Analysis
 25
 26### Investigating SSM Session Started to EC2 Instance
 27
 28This rule detects the first instance of an AWS resource initiating an SSM session to an EC2 instance, which could be indicative of legitimate administrative activities or potential malicious actions like command execution or lateral movement.
 29
 30#### Possible Investigation Steps
 31
 32- **Examine the Session Start Event**: Review the AWS CloudTrail log for the event.
 33    - Look for the `StartSession` action and verify details such as the `user_identity.arn`, `event.action`, and the target EC2 instance (`aws.cloudtrail.flattened.request_parameters`).
 34- **Verify User Identity and Role**: Check the user’s ARN and access key ID (`aws.cloudtrail.user_identity.access_key_id`).
 35    - Cross-reference this with IAM to verify if the user had the necessary permissions and if their role typically requires initiating SSM sessions.
 36- **Assess Geographic and IP Context**: Analyze the source IP (`source.ip`) and geographic location (`source.geo`) from which the session was initiated.
 37    - Determine if these are consistent with typical user locations or if they raise suspicions of compromise or misuse.
 38- **Review Session Details**: Examine details like the session ID and stream URL (`aws.cloudtrail.flattened.response_elements`) to understand the scope and nature of the session.
 39    - Check if any commands executed during the session were unauthorized or out of ordinary practices.
 40- **Correlate with Other Security Events**: Look for other related security events around the time of the session start to identify any pattern or broader attack vector that may involve this user or EC2 instance.
 41
 42### False Positive Analysis
 43
 44- **Legitimate Administrative Activities**: Confirm whether the SSM session was initiated for valid administrative purposes such as system maintenance, patching, or configuration updates. Verify with the respective teams or personnel.
 45
 46### Response and Remediation
 47
 48- **Immediate Session Review**: If the session initiation seems suspicious, review all actions taken during the session.
 49    - If possible, terminate the session to prevent any potential harm.
 50- **Validate and Reinforce Security Policies**: Ensure that policies around SSM session initiation are strict and adhere to the principle of least privilege.
 51    - Update IAM policies if necessary to tighten controls.
 52- **Incident Response Activation**: If malicious intent or actions are confirmed, activate the incident response protocol.
 53    - This includes containment of the threat, eradication of the adversary’s presence, recovery of affected systems, and a thorough investigation.
 54- **Enhance Monitoring and Alerts**: Improve monitoring of SSM sessions, particularly focusing on sessions that involve sensitive or critical EC2 instances.
 55    - Adjust alerting mechanisms to flag unusual session initiations promptly.
 56
 57### Additional Information
 58
 59For more in-depth understanding of managing SSM sessions and security best practices, refer to the [AWS Systems Manager documentation](https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_StartSession.html). Additionally, consider the security implications and best practices outlined in [AWS SSM privilege escalation techniques](https://cloud.hacktricks.xyz/pentesting-cloud/aws-security/aws-privilege-escalation/aws-ssm-privesc).
 60
 61"""
 62references = [
 63    "https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_StartSession.html",
 64    "https://hackingthe.cloud/aws/post_exploitation/intercept_ssm_communications/",
 65]
 66risk_score = 47
 67rule_id = "804a7ac8-fc00-11ee-924b-f661ea17fbce"
 68severity = "medium"
 69tags = [
 70    "Domain: Cloud",
 71    "Data Source: AWS",
 72    "Data Source: Amazon Web Services",
 73    "Data Source: AWS SSM",
 74    "Use Case: Threat Detection",
 75    "Tactic: Lateral Movement",
 76]
 77timestamp_override = "event.ingested"
 78type = "new_terms"
 79
 80query = '''
 81event.dataset:"aws.cloudtrail" and event.provider:"ssm.amazonaws.com"
 82    and event.action:"StartSession" and event.outcome:"success"
 83'''
 84
 85
 86[[rule.threat]]
 87framework = "MITRE ATT&CK"
 88[[rule.threat.technique]]
 89id = "T1021"
 90name = "Remote Services"
 91reference = "https://attack.mitre.org/techniques/T1021/"
 92[[rule.threat.technique.subtechnique]]
 93id = "T1021.007"
 94name = "Cloud Services"
 95reference = "https://attack.mitre.org/techniques/T1021/007/"
 96
 97
 98
 99[rule.threat.tactic]
100id = "TA0008"
101name = "Lateral Movement"
102reference = "https://attack.mitre.org/tactics/TA0008/"
103
104[rule.new_terms]
105field = "new_terms_fields"
106value = ["aws.cloudtrail.user_identity.arn"]
107[[rule.new_terms.history_window_start]]
108field = "history_window_start"
109value = "now-10d"

Triage and Analysis

Investigating SSM Session Started to EC2 Instance

This rule detects the first instance of an AWS resource initiating an SSM session to an EC2 instance, which could be indicative of legitimate administrative activities or potential malicious actions like command execution or lateral movement.

Possible Investigation Steps

  • Examine the Session Start Event: Review the AWS CloudTrail log for the event.
    • Look for the StartSession action and verify details such as the user_identity.arn, event.action, and the target EC2 instance (aws.cloudtrail.flattened.request_parameters).
  • Verify User Identity and Role: Check the user’s ARN and access key ID (aws.cloudtrail.user_identity.access_key_id).
    • Cross-reference this with IAM to verify if the user had the necessary permissions and if their role typically requires initiating SSM sessions.
  • Assess Geographic and IP Context: Analyze the source IP (source.ip) and geographic location (source.geo) from which the session was initiated.
    • Determine if these are consistent with typical user locations or if they raise suspicions of compromise or misuse.
  • Review Session Details: Examine details like the session ID and stream URL (aws.cloudtrail.flattened.response_elements) to understand the scope and nature of the session.
    • Check if any commands executed during the session were unauthorized or out of ordinary practices.
  • Correlate with Other Security Events: Look for other related security events around the time of the session start to identify any pattern or broader attack vector that may involve this user or EC2 instance.

False Positive Analysis

  • Legitimate Administrative Activities: Confirm whether the SSM session was initiated for valid administrative purposes such as system maintenance, patching, or configuration updates. Verify with the respective teams or personnel.

Response and Remediation

  • Immediate Session Review: If the session initiation seems suspicious, review all actions taken during the session.
    • If possible, terminate the session to prevent any potential harm.
  • Validate and Reinforce Security Policies: Ensure that policies around SSM session initiation are strict and adhere to the principle of least privilege.
    • Update IAM policies if necessary to tighten controls.
  • Incident Response Activation: If malicious intent or actions are confirmed, activate the incident response protocol.
    • This includes containment of the threat, eradication of the adversary’s presence, recovery of affected systems, and a thorough investigation.
  • Enhance Monitoring and Alerts: Improve monitoring of SSM sessions, particularly focusing on sessions that involve sensitive or critical EC2 instances.
    • Adjust alerting mechanisms to flag unusual session initiations promptly.

Additional Information

For more in-depth understanding of managing SSM sessions and security best practices, refer to the AWS Systems Manager documentation. Additionally, consider the security implications and best practices outlined in AWS SSM privilege escalation techniques.

References

Related rules

to-top