Detection rules › By event

AWS-ssm

Event	Rules
CreateAssociation	2
CreateDocument	1
DescribeInstancePatches	1
GetInventory	1
GetInventorySchema	1
GetParameter	2
GetParameters	2
ListCommands	1
ListInventoryEntries	1
RegisterManagedInstance	1
SendCommand	5
StartSession	1
DescribeInstanceInformation	1
ModifyDocumentPermission	1

CreateAssociation

2 detection rules reference this event. View event page.

Elastic (1)

AWS SSM Inventory Reconnaissance by Rare User severity medium T1518, T1538, T1580

Kusto (1)

AWSCloudTrail - Suspicious command sent to EC2 severity high T1651

CreateDocument

1 detection rules reference this event. View event page.

Elastic (1)

AWS SSM Command Document Created by Rare User severity high T1651

DescribeInstancePatches

1 detection rules reference this event. View event page.

Elastic (1)

AWS SSM Inventory Reconnaissance by Rare User severity medium T1518, T1538, T1580

GetInventory

1 detection rules reference this event. View event page.

Elastic (1)

AWS SSM Inventory Reconnaissance by Rare User severity medium T1518, T1538, T1580

GetInventorySchema

1 detection rules reference this event. View event page.

Elastic (1)

AWS SSM Inventory Reconnaissance by Rare User severity medium T1518, T1538, T1580

GetParameter

2 detection rules reference this event. View event page.

Elastic (1)

AWS Systems Manager SecureString Parameter Request with Decryption Flag severity medium T1555, T1555.006

Panther (1)

AWS Decrypt SSM Parameters severity medium T1555

GetParameters

2 detection rules reference this event. View event page.

Elastic (1)

AWS Systems Manager SecureString Parameter Request with Decryption Flag severity medium T1555, T1555.006

Panther (1)

AWS Decrypt SSM Parameters severity medium T1555

ListCommands

1 detection rules reference this event. View event page.

Elastic (1)

AWS SSM Inventory Reconnaissance by Rare User severity medium T1518, T1538, T1580

ListInventoryEntries

1 detection rules reference this event. View event page.

Elastic (1)

AWS SSM Inventory Reconnaissance by Rare User severity medium T1518, T1538, T1580

RegisterManagedInstance

1 detection rules reference this event. View event page.

Sigma (1)

Malicious Usage Of IMDS Credentials Outside Of AWS Infrastructure severity high T1078, T1078.002

SendCommand

5 detection rules reference this event. View event page.

Sigma (1)

Potential Malicious Usage of CloudTrail System Manager severity high T1566, T1566.002

Elastic (2)

AWS EC2 LOLBin Execution via SSM SendCommand severity medium T1059, T1059.004, T1105, T1651
AWS SSM `SendCommand` Execution by Rare User severity low T1651

Kusto (1)

AWSCloudTrail - Suspicious command sent to EC2 severity high T1651

Panther (1)

AWS SSM Distributed Command severity informational T1203

StartSession

1 detection rules reference this event. View event page.

Elastic (1)

AWS SSM Session Started to EC2 Instance severity high T1021, T1021.007

DescribeInstanceInformation

1 detection rules reference this event. View event page.

Panther (1)

AWS Software Discovery severity informational T1518

ModifyDocumentPermission

1 detection rules reference this event. View event page.

Kusto (1)

AWSCloudTrail - SSM document is publicly exposed severity medium T1526