detection.wiki

Detection rules › Sigma

Potential Malicious Usage of CloudTrail System Manager

Status
test
Severity
high
Log source
product aws, service cloudtrail
Author
jamesc-grafana
Source
github.com/SigmaHQ/sigma

Detect when System Manager successfully executes commands against an instance.

Known false positives

  • There are legitimate uses of SSM to send commands to EC2 instances
  • Legitimate users may have to use SSM to perform actions against machines in the Cloud to update or maintain them

MITRE ATT&CK coverage

TacticTechniques
Initial Access

Telemetry coverage

PlatformRecord / event type
AWSCloudTrail event SendCommand: Runs a Systems Manager document on one or more managed nodes, executing the specified commands or scripts.

Rules detecting the same action

These rules filter on the same operation.

Rule body

title: Potential Malicious Usage of CloudTrail System Manager
id: 38e7f511-3f74-41d4-836e-f57dfa18eead
status: test
description: |
    Detect when System Manager successfully executes commands against an instance.
references:
    - https://github.com/elastic/detection-rules/blob/v8.6.0/rules/integrations/aws/initial_access_via_system_manager.toml
author: jamesc-grafana
date: 2024-07-11
modified: 2025-12-08
tags:
    - attack.privilege-escalation
    - attack.initial-access
    - attack.t1566
    - attack.t1566.002
logsource:
    product: aws
    service: cloudtrail
detection:
    selection_event:
        eventName: 'SendCommand'
        eventSource: 'ssm.amazonaws.com'
    selection_status_success:
        errorCode: 'Success'
    selection_status_null:
        errorCode: null
    condition: selection_event and 1 of selection_status_*
falsepositives:
    - There are legitimate uses of SSM to send commands to EC2 instances
    - Legitimate users may have to use SSM to perform actions against machines in the Cloud to update or maintain them
level: high

Stages and Predicates

Stage 0: condition

selection_event and 1 of selection_status_*

Stage 1: selection_event

selection_event:
    eventName: 'SendCommand'
    eventSource: 'ssm.amazonaws.com'

Stage 2: selection_status_success

selection_status_success:
    errorCode: 'Success'

Stage 3: selection_status_null

selection_status_null:
    errorCode: null

Indicators

These rows show field, operator, and value matches.

FieldKindValuesSearch
errorCodeeq
  • Success
field:"aws::errorCode" kind:eq value:"Success"
errorCodeis_null
  • (no value, null check)
field:"aws::errorCode" kind:is_null
eventNameeq
  • SendCommand
field:"aws::eventName" kind:eq value:"SendCommand"
eventSourceeq
  • ssm.amazonaws.com
field:"aws::eventSource" kind:eq value:"ssm.amazonaws.com"