This activity allows threat actors to establish reverse shells, perform data exfiltration, or conduct lateral movement using pre-installed system utilities known as Living Off the Land Binaries (LOLBins). To effectively detect this behavior, security teams must correlate cloud-based API audit logs with endpoint process telemetry. By matching the unique SSM command ID across both data sources, defenders can uncover the actual command lines executed on the EC2 host, revealing the use of binaries such as curl, wget, socat, or python for malicious tasks.

Attack Chain

1. The attacker gains initial access to the AWS environment, obtaining credentials with sufficient permissions for the ssm:SendCommand action.
2. The attacker uses the AWS CLI or SDK to invoke the SendCommand API targeting a specific EC2 instance ID.
3. The request specifies the AWS-RunShellScript document, providing the malicious payload intended for execution.
4. The AWS SSM agent on the target EC2 instance receives the instruction and initiates a local shell process (typically _script.sh) to execute the provided commands.
5. The SSM agent executes the specified LOLBin (e.g., curl for exfiltration or python for a reverse shell).
6. The endpoint telemetry records the process creation, linking the execution to the parent SSM shell runner process.
7. The attacker verifies successful execution by polling the command status via the SSM ListCommandInvocations API.
8. The final objective, such as data exfiltration or persistence establishment, is achieved without direct network access to the EC2 instance.

Impact

Successful exploitation allows attackers to gain full remote control over EC2 instances, facilitating data theft, the deployment of backdoors, and deeper lateral movement within the cloud environment. This technique is particularly dangerous because it blends malicious activity with legitimate administrative traffic, complicates forensic analysis due to command redaction in cloud logs, and leverages trusted system binaries to evade signature-based detection.

Recommendation

Prioritize the correlation of CloudTrail logs and endpoint process execution data using the SSM command ID as the primary join key.

• Implement monitoring for the ssm:SendCommand action in CloudTrail logs specifically focusing on the use of the AWS-RunShellScript document.
• Enable endpoint telemetry for process creation events on all Linux-based EC2 instances to track the execution of known LOLBins.
• Configure alerting to detect when a process creation event involving a LOLBin is spawned by an SSM-related shell process (e.g., processes running from /document/orchestration/).
• Apply the principle of least privilege to IAM policies, restricting ssm:SendCommand permissions only to authorized identities and specific required instances.
• Require MFA for all IAM users and roles that possess permissions to execute SSM commands.
• Utilize VPC security groups to restrict outbound traffic from EC2 instances to prevent unauthorized data exfiltration via binaries like curl or wget.