{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/systems-manager/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["EC2","AWS Systems Manager","Systems Manager"],"_cs_severities":["high"],"_cs_tags":["cloud","linux","aws","living-off-the-land","execution","command-and-control","defense-evasion","cloud-administration-command"],"_cs_type":"advisory","_cs_vendors":["Amazon"],"content_html":"\u003cp\u003eAdversaries are increasingly abusing the AWS Systems Manager (SSM) SendCommand API to achieve remote code execution on EC2 instances. By invoking the AWS-RunShellScript document, attackers can execute arbitrary commands without requiring SSH or RDP access to the instance. Because AWS redacts sensitive command parameters within CloudTrail logs, traditional cloud-only monitoring often fails to capture the malicious intent behind these API calls.\u003c/p\u003e\n\u003cp\u003eThis activity allows threat actors to establish reverse shells, perform data exfiltration, or conduct lateral movement using pre-installed system utilities known as Living Off the Land Binaries (LOLBins). To effectively detect this behavior, security teams must correlate cloud-based API audit logs with endpoint process telemetry. By matching the unique SSM command ID across both data sources, defenders can uncover the actual command lines executed on the EC2 host, revealing the use of binaries such as curl, wget, socat, or python for malicious tasks.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eThe attacker gains initial access to the AWS environment, obtaining credentials with sufficient permissions for the ssm:SendCommand action.\u003c/li\u003e\n\u003cli\u003eThe attacker uses the AWS CLI or SDK to invoke the SendCommand API targeting a specific EC2 instance ID.\u003c/li\u003e\n\u003cli\u003eThe request specifies the AWS-RunShellScript document, providing the malicious payload intended for execution.\u003c/li\u003e\n\u003cli\u003eThe AWS SSM agent on the target EC2 instance receives the instruction and initiates a local shell process (typically _script.sh) to execute the provided commands.\u003c/li\u003e\n\u003cli\u003eThe SSM agent executes the specified LOLBin (e.g., \u003ccode\u003ecurl\u003c/code\u003e for exfiltration or \u003ccode\u003epython\u003c/code\u003e for a reverse shell).\u003c/li\u003e\n\u003cli\u003eThe endpoint telemetry records the process creation, linking the execution to the parent SSM shell runner process.\u003c/li\u003e\n\u003cli\u003eThe attacker verifies successful execution by polling the command status via the SSM ListCommandInvocations API.\u003c/li\u003e\n\u003cli\u003eThe final objective, such as data exfiltration or persistence establishment, is achieved without direct network access to the EC2 instance.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows attackers to gain full remote control over EC2 instances, facilitating data theft, the deployment of backdoors, and deeper lateral movement within the cloud environment. This technique is particularly dangerous because it blends malicious activity with legitimate administrative traffic, complicates forensic analysis due to command redaction in cloud logs, and leverages trusted system binaries to evade signature-based detection.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003ePrioritize the correlation of CloudTrail logs and endpoint process execution data using the SSM command ID as the primary join key.\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eImplement monitoring for the ssm:SendCommand action in CloudTrail logs specifically focusing on the use of the AWS-RunShellScript document.\u003c/li\u003e\n\u003cli\u003eEnable endpoint telemetry for process creation events on all Linux-based EC2 instances to track the execution of known LOLBins.\u003c/li\u003e\n\u003cli\u003eConfigure alerting to detect when a process creation event involving a LOLBin is spawned by an SSM-related shell process (e.g., processes running from /document/orchestration/).\u003c/li\u003e\n\u003cli\u003eApply the principle of least privilege to IAM policies, restricting ssm:SendCommand permissions only to authorized identities and specific required instances.\u003c/li\u003e\n\u003cli\u003eRequire MFA for all IAM users and roles that possess permissions to execute SSM commands.\u003c/li\u003e\n\u003cli\u003eUtilize VPC security groups to restrict outbound traffic from EC2 instances to prevent unauthorized data exfiltration via binaries like curl or wget.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-09-18T19:30:30Z","date_published":"2026-09-18T19:14:20Z","id":"https://feed.craftedsignal.io/briefs/2026-09-aws-ssm-lolbin-abuse/","summary":"Adversaries are abusing the AWS Systems Manager SendCommand API to remotely execute commands on EC2 instances by leveraging legitimate system utilities (LOLBins) to bypass CloudTrail parameter redaction.","title":"Abuse of AWS Systems Manager for Remote LOLBin Execution","url":"https://feed.craftedsignal.io/briefs/2026-09-aws-ssm-lolbin-abuse/"}],"language":"en","title":"CraftedSignal Threat Feed - Systems Manager","version":"https://jsonfeed.org/version/1.1"}