Potential Amazon SSM Agent Hijacking

Title: Potential Amazon SSM Agent Hijacking
Status: test
Description:Detects potential Amazon SSM agent hijack attempts as outlined in the Mitiga research report.
References:
  -https://www.mitiga.io/blog/mitiga-security-advisory-abusing-the-ssm-agent-as-a-remote-access-trojan
  -https://www.bleepingcomputer.com/news/security/amazons-aws-ssm-agent-can-be-used-as-post-exploitation-rat-malware/
  -https://www.helpnetsecurity.com/2023/08/02/aws-instances-attackers-access/
Author: Muhammad Faisal
Date: 2023-08-02
modified:None
Tags:

• -'attack.command-and-control'
• -'attack.persistence'
• -'attack.t1219.002'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection:
    Image|endswith: '\amazon-ssm-agent.exe'
    CommandLine|contains|all:
      -'-register '
      -'-code '
      -'-id '
      -'-region '

  condition:selection
Falsepositives:
  -Legitimate activity of system administrators
Level: medium