Analytics BIOC
Informational
✕
AWS Systems Manager hosts enumeration
A cloud identity enumerated hosts managed by AWS Systems Manager. Adversaries may use this API to discover SSM managed instances as a precursor to lateral movement or remote code execution.
- Module:
- Cortex Cloud
- Licensed by:
- Cloud Runtime Security (CRS)
- Data source:
- AWS Audit Log
ATT&CK tactics: Discovery (TA0007)
ATT&CK techniques: Cloud Infrastructure Discovery (T1580)
Detector tags: SSM Remote Management Analytics
Attacker's goals:
Discover SSM managed instances to plan lateral movement, remote command execution, or further reconnaissance.
Investigative actions:
Determine whether the identity legitimately needs to enumerate SSM managed instances. Review subsequent activity by the identity, especially SSM SendCommand, StartSession, or instance profile modifications. Validate the source IP and user-agent of the API call.
- Test period:
- N/A (single event)
- Deduplication:
- 5 Days
1 variation:
- AWS Systems Manager hosts enumeration via programmatic access Low (parent: Informational)