AWS SSM Agent Registered via Hybrid Activation

  1[metadata]
  2creation_date = "2026/09/14"
  3integration = ["endpoint", "crowdstrike", "sentinel_one_cloud_funnel"]
  4maturity = "production"
  5updated_date = "2026/09/14"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Identifies the Amazon SSM Agent invoked with "-register" and a hybrid activation argument on a Linux host. Hybrid
 11activation is how non-EC2 hosts are onboarded as managed nodes, but adversaries with local access can repurpose the
 12pre-installed, root-privileged SSM Agent as a covert remote access trojan by registering it to an attacker-controlled
 13AWS account, gaining a persistent command channel that blends in with legitimate management traffic. On an EC2
 14instance that already runs the agent under an instance profile, a hybrid registration is highly unusual. The query
 15cannot tell which account received the registration; the investigation guide explains how to confirm it.
 16"""
 17false_positives = [
 18    """
 19    Hybrid activation is a legitimate operation when onboarding on-premises or non-EC2 hosts as managed nodes for
 20    the first time, and re-registration after an agent reinstall. De-registration ("-register -clear") does not
 21    match this rule. Add exceptions for known provisioning automation or onboarding hosts if this fires in
 22    expected environments.
 23    """,
 24]
 25from = "now-9m"
 26index = ["logs-endpoint.events.process*", "logs-crowdstrike.fdr*", "logs-sentinel_one_cloud_funnel.*"]
 27language = "kuery"
 28license = "Elastic License v2"
 29name = "AWS SSM Agent Registered via Hybrid Activation"
 30references = [
 31    "https://www.mitiga.io/blog/abusing-the-amazon-web-services-ssm-agent-as-a-remote-access-trojan",
 32    "https://thehackernews.com/2023/08/researchers-uncover-aws-ssm-agent.html",
 33    "https://www.paloaltonetworks.com/blog/security-operations/aws-systems-manager-attack-vectors/",
 34]
 35risk_score = 47
 36rule_id = "5f366163-8de9-46ad-91d2-541deaf56864"
 37note = """## Triage and analysis
 38
 39### Investigating AWS SSM Agent Registered via Hybrid Activation
 40
 41This rule detects the Amazon SSM Agent being registered with a hybrid activation code or ID on a Linux host. On EC2 instances that already run the agent this is anomalous and may indicate an adversary hijacking the agent as a persistent command channel to an AWS account they control. On non-EC2 hosts it is the normal onboarding path and must be confirmed against provisioning records.
 42
 43### Possible investigation steps
 44
 45- Review the process arguments for the activation code, activation ID, and region. These do not reveal the AWS account; use the next two steps to determine it.
 46- Read `/var/lib/amazon/ssm/registration` on the host. A `ManagedInstanceID` starting with `mi-` means the agent is hybrid-registered; on an EC2 instance this should be an `i-` instance ID.
 47- Search CloudTrail across all organization accounts for `RegisterManagedInstance` and `CreateActivation` events with that activation ID. If none of your accounts recorded it, the agent was registered to an external account.
 48- Investigate the parent process and user session to understand how the registration command was initiated and whether it was interactive.
 49- Determine if the user session that ran the command was interactive or came from an automated process.
 50
 51### False positive analysis
 52
 53- Hybrid activation is a legitimate operation when onboarding on-premises or non-EC2 hosts as managed nodes for the first time. On already-registered EC2 instances this sequence is anomalous.
 54- Allowlist known provisioning automation identities if this fires in expected environments.
 55
 56### Response and remediation
 57
 58- Initiate the incident response process based on the outcome of the triage.
 59- Isolate the affected host to prevent the attacker from issuing further SSM commands.
 60- Re-register the SSM Agent with the correct organization-owned AWS account.
 61- Rotate any instance credentials that may have been accessible to the attacker during the rogue registration window.
 62- Review SSM Session Manager history for commands executed through the rogue registration.
 63"""
 64setup = """## Setup
 65
 66This rule requires data coming in from Elastic Defend.
 67
 68### Elastic Defend Integration Setup
 69Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the
 70Elastic Agent to monitor events on your host and send data to the Elastic Security app.
 71
 72#### Prerequisite Requirements:
 73- Fleet is required for Elastic Defend.
 74- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html).
 75
 76#### The following steps should be executed in order to add the Elastic Defend integration:
 77- Go to the Kibana home page and click "Add integrations".
 78- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
 79- Click "Add Elastic Defend".
 80- Configure the integration name and optionally add a description.
 81- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
 82- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can
 83  click the "Existing hosts" tab and select an existing policy instead.
 84- Click "Save and Continue".
 85- To complete the integration, select "Add Elastic Agent to your hosts" and install Elastic Agent on your hosts.
 86For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html).
 87"""
 88severity = "medium"
 89tags = [
 90    "Domain: Endpoint",
 91    "Domain: Cloud",
 92    "Platform: AWS",
 93    "Platform: Linux",
 94    "OS: Linux",
 95    "Service: AWS SSM",
 96    "Tactic: Command and Control",
 97    "Tactic: Persistence",
 98    "Data Source: Elastic Defend",
 99    "Data Source: Crowdstrike",
100    "Data Source: SentinelOne",
101    "Rule Type: Custom Query (KQL)",
102    "Resources: Investigation Guide",
103]
104timestamp_override = "event.ingested"
105type = "query"
106
107query = '''
108event.category : process and host.os.type : linux and event.type : start and
109event.action : (ProcessRollup2 or exec or exec_event or start) and
110(
111  process.name : (amazon-ssm-agent or ssm-agent-worker or ssm-setup-cli) or
112  process.executable : (/snap/amazon-ssm-agent/*/amazon-ssm-agent or /usr/bin/amazon-ssm-agent or /usr/bin/ssm-setup-cli)
113) and
114process.args : (
115  (-register or --register) and
116  (
117    -activation-code or -activation-code=* or --activation-code or --activation-code=* or
118    -activation-id or -activation-id=* or --activation-id or --activation-id=* or
119    -code or -code=* or --code or --code=* or
120    -id or -id=* or --id or --id=*
121  )
122)
123'''
124
125[[rule.threat]]
126framework = "MITRE ATT&CK"
127
128[[rule.threat.technique]]
129id = "T1219"
130name = "Remote Access Tools"
131reference = "https://attack.mitre.org/techniques/T1219/"
132
133[rule.threat.tactic]
134id = "TA0011"
135name = "Command and Control"
136reference = "https://attack.mitre.org/tactics/TA0011/"
137
138[[rule.threat]]
139framework = "MITRE ATT&CK"
140
141[[rule.threat.technique]]
142id = "T1133"
143name = "External Remote Services"
144reference = "https://attack.mitre.org/techniques/T1133/"
145
146[rule.threat.tactic]
147id = "TA0003"
148name = "Persistence"
149reference = "https://attack.mitre.org/tactics/TA0003/"