AWS CloudTrail SSM SendCommand Successful Execution for Instance

Identifies successful AWS SSM SendCommand executions recorded in CloudTrail.

FreeReviewedSigma · High · v5

Product: aws
Service: cloudtrail
Author: jamesc-grafana (SigmaHQ), DRL 1.1
Published: 2024-07-11
Updated: 2026-07-31

ATT&CK techniques

Initial Access

Recon
Resource Dev
Initial Access
- T1566Phishing
- T1566.002Spearphishing Link
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags CloudTrail events where AWS Systems Manager (SSM) successfully runs a SendCommand to an instance. Successful command execution is significant because attackers can use SSM to execute actions on managed hosts without direct interactive access. The detection relies on CloudTrail telemetry for eventName "SendCommand", eventSource "ssm.amazonaws.com", and an errorCode of "Success" (including the matching null/errorCode-null success condition).

Reporting behind it

Related detections9 linkedT1566.002 — drag to rearrange

Suspicious Microsoft Entra Device Code Authentication Flow

macOS Script Editor Spawns Suspicious Command-Line Interpreters

Suspicious Windows Script Host Execution of JavaScript from Temporary Archive Extraction Folder (via process_creation)

Suspicious OAuth Application Consent Grant via Azure Audit Logs

Suspicious OWA Proxy User-Agent Indicating Mailbox Access

Suspicious Anonymous Sharing Link Creation in SharePoint or OneDrive via M365 Audit

Suspicious Gammadyne Mailer Execution for Direct-to-MX Spam

Suspicious Screensaver File Executed as Installer via process_creation

Suspicious M365 Device Code Authentication Flow via m365

AWS CloudTrail SSM SendCommand Successful Execution for Instance

Pivot detection · T1566.002 · 9 related

Changelog

v5
Candidate ingested via manual entry.2026-07-31
v4
Candidate ingested via manual entry.2026-07-31
v3
Candidate ingested via manual entry.2026-07-31
v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

aws-cloudtrail-ssm-sendcommand-with-successful-execution-38e7f511

title: AWS CloudTrail SSM SendCommand Successful Execution for Instance
id: 8ae1ab0c-ef3d-4bd1-9c58-d9071d7e0976
status: test
description: This rule flags CloudTrail events where AWS Systems Manager (SSM) successfully runs a SendCommand to an instance. Successful command execution is significant because attackers can use SSM to execute actions on managed hosts without direct interactive access. The detection relies on CloudTrail telemetry for eventName "SendCommand", eventSource "ssm.amazonaws.com", and an errorCode of "Success" (including the matching null/errorCode-null success condition).
references:
  - https://github.com/elastic/detection-rules/blob/v8.6.0/rules/integrations/aws/initial_access_via_system_manager.toml
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/aws/cloudtrail/aws_cloudtrail_ssm_malicious_usage.yml
author: jamesc-grafana, Huntrule Team
date: 2024-07-11
modified: 2025-12-08
tags:
  - attack.privilege-escalation
  - attack.initial-access
  - attack.t1566
  - attack.t1566.002
logsource:
  product: aws
  service: cloudtrail
detection:
  selection_event:
    eventName: SendCommand
    eventSource: ssm.amazonaws.com
  selection_status_success:
    errorCode: Success
  selection_status_null:
    errorCode: null
  condition: selection_event and 1 of selection_status_*
falsepositives:
  - There are legitimate uses of SSM to send commands to EC2 instances
  - Legitimate users may have to use SSM to perform actions against machines in the Cloud to update or maintain them
level: high
license: DRL-1.1
related:
  - id: 38e7f511-3f74-41d4-836e-f57dfa18eead
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL