-
AWS EC2 LOLBin Execution via SSM SendCommand
Sep 19, 2026 · Domain: Cloud Domain: Endpoint OS: Linux Use Case: Threat Detection Tactic: Execution Tactic: Command and Control Data Source: AWS Data Source: Amazon Web Services Data Source: AWS CloudTrail Data Source: AWS EC2 Data Source: AWS SSM Data Source: AWS Systems Manager Data Source: Elastic Defend Resources: Investigation Guide Noise: Low Performance: Normal Profile: Recommended Threat: Living off the Land Threat: Cloud VM Execution Rule Type: ES|QL Platform: Linux Platform: AWS Service: AWS EC2 Service: AWS SSM ·Identifies the execution of Living Off the Land Binaries (LOLBins) or GTFOBins on EC2 instances via AWS Systems Manager (SSM)
SendCommandAPI. This detection correlates AWS CloudTrailSendCommandevents with endpoint process execution by matching SSM command IDs. While AWS redacts command parameters in CloudTrail logs, this correlation technique reveals the actual commands executed on EC2 instances. Adversaries may abuse SSM to execute malicious commands remotely without requiring SSH or RDP access, using legitimate system utilities for data exfiltration, establishing reverse shells, or lateral movement.
Read More -
AWS SSM
SendCommandExecution by Rare UserSep 19, 2026 · Domain: Cloud Data Source: AWS Data Source: Amazon Web Services Data Source: AWS SSM Data Source: AWS Systems Manager Use Case: Log Auditing Use Case: Threat Detection Tactic: Execution Resources: Investigation Guide Noise: High Performance: Normal Profile: Aggressive Threat: Cloud VM Execution Rule Type: New Terms Platform: AWS Data Source: AWS CloudTrail Service: AWS SSM ·Detects the execution of commands or scripts on EC2 instances using AWS Systems Manager (SSM), such as RunShellScript, RunPowerShellScript or custom documents. While legitimate users may employ these commands for management tasks, they can also be exploited by attackers with credentials to establish persistence, install malware, or execute reverse shells for further access to compromised instances. This is a New Terms rule that looks for the first instance of this behavior by a user or role.
Read More -
AWS SSM Command Document Created by Rare User
Sep 19, 2026 · Domain: Cloud Data Source: AWS Data Source: Amazon Web Services Data Source: AWS SSM Data Source: AWS Systems Manager Resources: Investigation Guide Use Case: Threat Detection Tactic: Execution Noise: Low Performance: Normal Rule Type: New Terms Platform: AWS Data Source: AWS CloudTrail Service: AWS SSM ·Identifies when an AWS Systems Manager (SSM) command document is created by a user or role who does not typically perform this action. Adversaries may create SSM command documents to execute commands on managed instances, potentially leading to unauthorized access, command and control, data exfiltration and more.
Read More -
Detects the rare occurrence of a user or role accessing AWS Systems Manager (SSM) inventory APIs or running the AWS-GatherSoftwareInventory job. These APIs reveal detailed information about managed EC2 instances including installed software, patch compliance status, and command execution history. Adversaries may use these calls to collect software inventory while blending in with legitimate AWS operations. This is a New Terms rule that detects when a user accesses these reconnaissance APIs for the first time.
Read More -
AWS SSM Session Started to EC2 Instance
Sep 19, 2026 · Domain: Cloud Data Source: AWS Data Source: Amazon Web Services Data Source: AWS SSM Data Source: AWS EC2 Use Case: Threat Detection Tactic: Lateral Movement Resources: Investigation Guide Noise: Low Performance: Normal Rule Type: New Terms Platform: AWS Data Source: AWS CloudTrail Service: AWS EC2 Service: AWS SSM ·Identifies the first occurrence of an AWS user or role establishing a session via SSM to an EC2 instance. Adversaries may use AWS Session Manager to establish a session to an EC2 instance to execute commands on the instance. This can be used to gain access to the instance and perform actions such as privilege escalation.
Read More -
Detects the first occurrence of a user identity accessing AWS Systems Manager (SSM) SecureString parameters using the GetParameter or GetParameters API actions with credentials in the request parameters. This could indicate that the user is accessing sensitive information. This rule detects when a user accesses a SecureString parameter with the withDecryption parameter set to true. This is a New Terms rule that detects the first occurrence of an AWS identity accessing SecureString parameters with decryption.
Read More