{"id":"38e7f511-3f74-41d4-836e-f57dfa18eead","title":"Potential Malicious Usage of CloudTrail System Manager","description":"Detect when System Manager successfully executes commands against an instance.\n","author":"jamesc-grafana","status":"test","level":"high","date":"2024-07-11","modified":"2025-12-08","tags":["attack.privilege-escalation","attack.initial-access","attack.t1566","attack.t1566.002"],"technique_ids":["T1566","T1566.002"],"logsource":{"product":"aws","service":"cloudtrail"},"falsepositives":["There are legitimate uses of SSM to send commands to EC2 instances","Legitimate users may have to use SSM to perform actions against machines in the Cloud to update or maintain them"],"references":["https://github.com/elastic/detection-rules/blob/v8.6.0/rules/integrations/aws/initial_access_via_system_manager.toml"],"source_path":"rules/cloud/aws/cloudtrail/aws_cloudtrail_ssm_malicious_usage.yml","source_sha256":"3d394a4a27a2af7c93034177c376f0358e13b29999074dda031334b7c92b2cc9","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/cloud/aws/cloudtrail/aws_cloudtrail_ssm_malicious_usage.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Potential Malicious Usage of CloudTrail System Manager\nid: 38e7f511-3f74-41d4-836e-f57dfa18eead\nstatus: test\ndescription: |\n    Detect when System Manager successfully executes commands against an instance.\nreferences:\n    - https://github.com/elastic/detection-rules/blob/v8.6.0/rules/integrations/aws/initial_access_via_system_manager.toml\nauthor: jamesc-grafana\ndate: 2024-07-11\nmodified: 2025-12-08\ntags:\n    - attack.privilege-escalation\n    - attack.initial-access\n    - attack.t1566\n    - attack.t1566.002\nlogsource:\n    product: aws\n    service: cloudtrail\ndetection:\n    selection_event:\n        eventName: 'SendCommand'\n        eventSource: 'ssm.amazonaws.com'\n    selection_status_success:\n        errorCode: 'Success'\n    selection_status_null:\n        errorCode: null\n    condition: selection_event and 1 of selection_status_*\nfalsepositives:\n    - There are legitimate uses of SSM to send commands to EC2 instances\n    - Legitimate users may have to use SSM to perform actions against machines in the Cloud to update or maintain them\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1566","id":"T1566","name":"Phishing","page":"techniques/enterprise/T1566/"},{"key":"enterprise/T1566.002","id":"T1566.002","name":"Spearphishing Link","page":"techniques/enterprise/T1566.002/"}],"data_path":"data/detection-rules/38e7f511-3f74-41d4-836e-f57dfa18eead.json","kind":"sigma"}