AWS CloudTrail: SSM SendCommand With Successful Execution

Identifies successful AWS SSM SendCommand executions recorded in CloudTrail.

FreeUnreviewedSigmahighv1

aws-cloudtrail-ssm-sendcommand-with-successful-execution-38e7f511

title: "AWS CloudTrail: SSM SendCommand With Successful Execution"
id: 8ae1ab0c-ef3d-4bd1-9c58-d9071d7e0976
status: test
description: This rule flags CloudTrail events where AWS Systems Manager (SSM) successfully runs a SendCommand request against an instance. Successful command execution is a key step for adversaries using SSM to execute actions on managed hosts, including initial access or post-compromise activity. It relies on CloudTrail telemetry for eventName=SendCommand, eventSource=ssm.amazonaws.com, and errorCode indicating Success (or null).
references:
  - https://github.com/elastic/detection-rules/blob/v8.6.0/rules/integrations/aws/initial_access_via_system_manager.toml
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/aws/cloudtrail/aws_cloudtrail_ssm_malicious_usage.yml
author: jamesc-grafana, Huntrule Team
date: 2024-07-11
modified: 2025-12-08
tags:
  - attack.privilege-escalation
  - attack.initial-access
  - attack.t1566
  - attack.t1566.002
logsource:
  product: aws
  service: cloudtrail
detection:
  selection_event:
    eventName: SendCommand
    eventSource: ssm.amazonaws.com
  selection_status_success:
    errorCode: Success
  selection_status_null:
    errorCode: null
  condition: selection_event and 1 of selection_status_*
falsepositives:
  - There are legitimate uses of SSM to send commands to EC2 instances
  - Legitimate users may have to use SSM to perform actions against machines in the Cloud to update or maintain them
level: high
license: DRL-1.1
related:
  - id: 38e7f511-3f74-41d4-836e-f57dfa18eead
    type: derived

What it detects

This rule flags CloudTrail events where AWS Systems Manager (SSM) successfully runs a SendCommand request against an instance. Successful command execution is a key step for adversaries using SSM to execute actions on managed hosts, including initial access or post-compromise activity. It relies on CloudTrail telemetry for eventName=SendCommand, eventSource=ssm.amazonaws.com, and errorCode indicating Success (or null).

Known false positives

There are legitimate uses of SSM to send commands to EC2 instances
Legitimate users may have to use SSM to perform actions against machines in the Cloud to update or maintain them

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.