AWS CloudTrail SSM SendCommand Successful Execution for Instance

Identifies successful AWS SSM SendCommand executions recorded in CloudTrail.

FreeReviewedSigma · High · v5

Product: aws
Service: cloudtrail
Author: jamesc-grafana (SigmaHQ), DRL 1.1
Published: 2024-07-11
Updated: 2026-07-31

ATT&CK techniques

Initial Access

Recon
Resource Dev
Initial Access
- T1566Phishing
- T1566.002Spearphishing Link
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags CloudTrail events where AWS Systems Manager (SSM) successfully runs a SendCommand to an instance. Successful command execution is significant because attackers can use SSM to execute actions on managed hosts without direct interactive access. The detection relies on CloudTrail telemetry for eventName "SendCommand", eventSource "ssm.amazonaws.com", and an errorCode of "Success" (including the matching null/errorCode-null success condition).

Reporting behind it

Related detections9 linkedT1566.002 — drag to rearrange

macOS Script Editor Spawns Suspicious Command-Line Interpreters

Suspicious Cloudflare Workers Brand-Impersonation Phishing Domains via Proxy

Suspicious NFe-Themed Brazilian Lure Executable Execution

Malicious Office 365 Email Rule Breach - On Behalf (via office365)

Suspicious Phishing URL with Unrendered Template Placeholder (via proxy)

Suspicious Spoofed Inbound Email With Failed Authentication and Anonymous Internal Sender (via m365)

Malicious Credential Harvesting Request via All-in-1 PHP Endpoint (via proxy)

Suspicious Error 524 Decoy Smishing Phishing Endpoint Access (via proxy)

Suspicious 0ktapus Phishing Kit Credential Post Path Access

AWS CloudTrail SSM SendCommand Successful Execution for Instance

Pivot detection · T1566.002 · 9 related

Changelog

v5
Candidate ingested via manual entry.2026-07-31
v4
Candidate ingested via manual entry.2026-07-31
v3
Candidate ingested via manual entry.2026-07-31
v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

aws-cloudtrail-ssm-sendcommand-with-successful-execution-38e7f511

title: AWS CloudTrail SSM SendCommand Successful Execution for Instance
id: 8ae1ab0c-ef3d-4bd1-9c58-d9071d7e0976
status: test
description: This rule flags CloudTrail events where AWS Systems Manager (SSM) successfully runs a SendCommand to an instance. Successful command execution is significant because attackers can use SSM to execute actions on managed hosts without direct interactive access. The detection relies on CloudTrail telemetry for eventName "SendCommand", eventSource "ssm.amazonaws.com", and an errorCode of "Success" (including the matching null/errorCode-null success condition).
references:
  - https://github.com/elastic/detection-rules/blob/v8.6.0/rules/integrations/aws/initial_access_via_system_manager.toml
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/aws/cloudtrail/aws_cloudtrail_ssm_malicious_usage.yml
author: jamesc-grafana, Huntrule Team
date: 2024-07-11
modified: 2025-12-08
tags:
  - attack.privilege-escalation
  - attack.initial-access
  - attack.t1566
  - attack.t1566.002
logsource:
  product: aws
  service: cloudtrail
detection:
  selection_event:
    eventName: SendCommand
    eventSource: ssm.amazonaws.com
  selection_status_success:
    errorCode: Success
  selection_status_null:
    errorCode: null
  condition: selection_event and 1 of selection_status_*
falsepositives:
  - There are legitimate uses of SSM to send commands to EC2 instances
  - Legitimate users may have to use SSM to perform actions against machines in the Cloud to update or maintain them
level: high
license: DRL-1.1
related:
  - id: 38e7f511-3f74-41d4-836e-f57dfa18eead
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL