Linux Amazon SSM Agent Hijacking via Suspicious -register/-code Command-Line

title: Linux Amazon SSM Agent Hijacking via Suspicious -register/-code Command-Line
id: bee211c2-e75b-4eba-9cd2-0a48ceb5789d
status: test
description: "This rule flags Linux executions of a binary ending with /amazon-ssm-agent when the command line contains the full set of registration parameters: -register, -code, -id, and -region. Attackers can abuse SSM agent registration behavior to establish remote access and persistence by repurposing the agent. The detection relies on process creation telemetry, matching the executable path suffix and the presence of these specific command-line flags."
references:
  - https://www.mitiga.io/blog/mitiga-security-advisory-abusing-the-ssm-agent-as-a-remote-access-trojan
  - https://www.bleepingcomputer.com/news/security/amazons-aws-ssm-agent-can-be-used-as-post-exploitation-rat-malware/
  - https://www.helpnetsecurity.com/2023/08/02/aws-instances-attackers-access/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_ssm_agent_abuse.yml
author: Muhammad Faisal, Huntrule Team
date: 2023-08-03
tags:
  - attack.command-and-control
  - attack.persistence
  - attack.t1219.002
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    Image|endswith: /amazon-ssm-agent
    CommandLine|contains|all:
      - "-register "
      - "-code "
      - "-id "
      - "-region "
  condition: selection
falsepositives:
  - Legitimate activity of system administrators
level: medium
license: DRL-1.1
related:
  - id: f9b3edc5-3322-4fc7-8aa3-245d646cc4b7
    type: derived