{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata — refreshed continuously.","feed_url":"https://feed.craftedsignal.io/products/aws-systems-manager-session-manager/","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cves":[],"_cs_exploited":false,"_cs_products":["AWS Systems Manager Session Manager"],"_cs_severities":["medium"],"_cs_tags":["aws","ssm","session-manager","execution","cloud"],"_cs_type":"advisory","_cs_vendors":["Amazon"],"content_html":"\u003cp\u003eAWS Systems Manager (SSM) Session Manager provides interactive shell access to EC2 instances and hybrid nodes without the need for bastion hosts or open inbound ports. Attackers can abuse this functionality by leveraging compromised AWS credentials or IAM roles with \u003ccode\u003essm:StartSession\u003c/code\u003e permissions to gain unauthorized access to target systems. This allows for remote execution of commands and lateral movement within the AWS environment. The technique involves spawning child processes from the SSM session worker process to perform malicious activities. Defenders should monitor for unusual process execution patterns originating from SSM sessions to identify potential abuse.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker gains access to valid AWS credentials or IAM role with \u003ccode\u003essm:StartSession\u003c/code\u003e permissions.\u003c/li\u003e\n\u003cli\u003eAttacker initiates an SSM session to a target EC2 instance or hybrid node using the compromised credentials.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003essm-session-worker\u003c/code\u003e process is started on the target instance to manage the interactive session.\u003c/li\u003e\n\u003cli\u003eAttacker executes commands within the session, spawning child processes from the \u003ccode\u003essm-session-worker\u003c/code\u003e process.\u003c/li\u003e\n\u003cli\u003eAttacker may use scripting languages such as PowerShell or Bash to execute malicious code (e.g., using \u003ccode\u003eawsrunPowerShellScript\u003c/code\u003e or \u003ccode\u003eawsrunShellScript\u003c/code\u003e).\u003c/li\u003e\n\u003cli\u003eThese scripts perform reconnaissance, download additional tools, or attempt credential access.\u003c/li\u003e\n\u003cli\u003eAttacker moves laterally to other instances or resources within the AWS environment.\u003c/li\u003e\n\u003cli\u003eThe ultimate objective is often data exfiltration, privilege escalation, or maintaining persistent access.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation can lead to unauthorized access to sensitive data, compromise of critical systems, and lateral movement within the AWS environment. The impact can range from data breaches to complete control of the compromised infrastructure. The number of affected systems depends on the scope of the compromised credentials and the attacker\u0026rsquo;s ability to move laterally. Organizations using AWS SSM are at risk.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eDeploy the Sigma rules in this brief to your SIEM and tune for your environment to detect suspicious child processes spawned by \u003ccode\u003essm-session-worker\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eCorrelate process activity with AWS CloudTrail logs for \u003ccode\u003eStartSession\u003c/code\u003e and related API calls to identify the IAM principal initiating the session (see the overview section for API names).\u003c/li\u003e\n\u003cli\u003eImplement strict IAM policies and regularly review AWS credentials to minimize the risk of credential compromise.\u003c/li\u003e\n\u003cli\u003eMonitor \u003ccode\u003eprocess.command_line\u003c/code\u003e, \u003ccode\u003eprocess.executable\u003c/code\u003e, \u003ccode\u003eprocess.user.name\u003c/code\u003e for unusual activity within SSM sessions.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-05-01T20:57:28Z","date_published":"2026-05-01T20:57:28Z","id":"/briefs/2024-01-aws-ssm-session-manager-abuse/","summary":"Adversaries abuse AWS Systems Manager (SSM) Session Manager to gain remote execution and lateral movement within AWS environments by spawning malicious child processes from the SSM session worker, leveraging legitimate AWS credentials and IAM permissions.","title":"AWS SSM Session Manager Child Process Execution Abuse","url":"https://feed.craftedsignal.io/briefs/2024-01-aws-ssm-session-manager-abuse/"}],"language":"en","title":"CraftedSignal Threat Feed — AWS Systems Manager Session Manager","version":"https://jsonfeed.org/version/1.1"}