Analytics BIOC Informational
✕

Unusual AWS systems manager activity

A cloud identity performed an SSM operation for the first time.

Module:
Cortex Cloud
Licensed by:
Cloud Runtime Security (CRS)
Data source:
AWS Audit Log
ATT&CK tactics: Discovery (TA0007) Lateral Movement (TA0008)
ATT&CK techniques: Cloud Service Discovery (T1526) Remote Services: Cloud Services (T1021.007)
Detector tags: SSM Remote Management Analytics
Attacker's goals:

Manipulate SSM operations to take control over EC2 instances and strengthen the foothold in the cloud environment of the organization, by running critical operating system commands, manipulating the parameters store, and patch management configuration.

Investigative actions:

Check the identity's role designation in the organization. Verify that the identity did not perform any sensitive SSM operation that it shouldn't.

Test period:
N/A (single event)
Deduplication:
1 Day