Skip to content
Threat Feed
Subscribe

Product

Systems Manager

1 brief RSS
high advisory

Abuse of AWS Systems Manager for Remote LOLBin Execution

Adversaries are abusing the AWS Systems Manager SendCommand API to remotely execute commands on EC2 instances by leveraging legitimate system utilities (LOLBins) to bypass CloudTrail parameter redaction.

EC2 +2 cloud linux aws living-off-the-land execution command-and-control defense-evasion cloud-administration-command
1r 4t