Attack Chain

1. Initial Access: An attacker gains access to an AWS account through compromised credentials or an exposed IAM role.
2. Credential Harvesting: The attacker enumerates existing IAM roles and policies to identify those with permissions to interact with SSM.
3. SSM Enumeration: The attacker uses the sts:GetCallerIdentity API call to validate permissions and identify the current AWS account.
4. Inventory Discovery: The attacker leverages SSM inventory APIs, such as ssm:GetInventory, ssm:GetInventorySchema, and ssm:ListInventoryEntries, to gather information about EC2 instances, including installed software and patch levels.
5. Patch Status Check: The attacker uses ssm:DescribeInstancePatches to identify vulnerable or unpatched systems.
6. Command History Check: The attacker uses ssm:ListCommands to gather information about past commands executed on the instances.
7. Software Inventory Job Execution: Alternatively, the attacker triggers the AWS-GatherSoftwareInventory job using ssm:CreateAssociation to collect a comprehensive software inventory.
8. Lateral Movement: Based on the gathered inventory, the attacker identifies vulnerable systems or misconfigurations and attempts lateral movement within the AWS environment.

Impact

Successful reconnaissance using AWS SSM Inventory APIs allows attackers to map out the target environment, identify vulnerable systems, and plan further attacks, such as lateral movement or data exfiltration. This reconnaissance can lead to full compromise of EC2 instances and sensitive data within the AWS environment. Scattered Spider and similar groups often use this information to identify high-value targets and vulnerabilities for exploitation.

Recommendation

• Deploy the Sigma rule "AWS SSM Inventory Reconnaissance by Rare User" to your SIEM to detect anomalous SSM inventory API usage (rule).
• Investigate any alerts triggered by the Sigma rule, focusing on the source IP address, user agent, and the specific API calls made (rule).
• Review IAM permissions to ensure that users and roles only have the necessary permissions to access SSM inventory data (IAM).
• Implement enhanced monitoring for users or roles identified as performing suspicious SSM activity (monitoring).
• Correlate SSM API activity with other AWS CloudTrail events, such as StartSession or SendCommand, to identify broader attack patterns (CloudTrail).
• Use the provided references to understand Scattered Spider's TTPs and AWS security best practices (references).