Linux Amazon SSM Agent Hijack Indicators via Suspicious Agent Registration Arguments
Alerts when the Linux amazon-ssm-agent is run with full SSM registration flags (-register, -code, -id, -region).
- Product
- linux
- Category
- process_creation
- Author
- Muhammad Faisal (SigmaHQ), DRL 1.1
- Published
- 2023-08-03
- Updated
- 2026-07-31
ATT&CK techniques
C2Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
Exfiltration
Impact
What it detects
This rule flags process executions where the binary path ends with /amazon-ssm-agent and the command line includes the full set of registration parameters (-register, -code, -id, and -region). Attackers can abuse the SSM agent to establish remote access and persist within a Linux environment by registering an unauthorized agent. The detection relies on Linux process creation telemetry containing the process image path and full command line arguments.
Reporting behind it
- mitiga.iohttps://www.mitiga.io/blog/mitiga-security-advisory-abusing-the-ssm-agent-as-a-remote-access-trojan
- bleepingcomputer.comhttps://www.bleepingcomputer.com/news/security/amazons-aws-ssm-agent-can-be-used-as-post-exploitation-rat-malware/
- helpnetsecurity.comhttps://www.helpnetsecurity.com/2023/08/02/aws-instances-attackers-access/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_ssm_agent_abuse.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Linux Amazon SSM Agent Hijack Indicators via Suspicious Agent Registration Arguments
id: bee211c2-e75b-4eba-9cd2-0a48ceb5789d
status: test
description: This rule flags process executions where the binary path ends with /amazon-ssm-agent and the command line includes the full set of registration parameters (-register, -code, -id, and -region). Attackers can abuse the SSM agent to establish remote access and persist within a Linux environment by registering an unauthorized agent. The detection relies on Linux process creation telemetry containing the process image path and full command line arguments.
references:
- https://www.mitiga.io/blog/mitiga-security-advisory-abusing-the-ssm-agent-as-a-remote-access-trojan
- https://www.bleepingcomputer.com/news/security/amazons-aws-ssm-agent-can-be-used-as-post-exploitation-rat-malware/
- https://www.helpnetsecurity.com/2023/08/02/aws-instances-attackers-access/
- https://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_ssm_agent_abuse.yml
author: Muhammad Faisal, Huntrule Team
date: 2023-08-03
tags:
- attack.command-and-control
- attack.persistence
- attack.t1219.002
logsource:
category: process_creation
product: linux
detection:
selection:
Image|endswith: /amazon-ssm-agent
CommandLine|contains|all:
- "-register "
- "-code "
- "-id "
- "-region "
condition: selection
falsepositives:
- Legitimate activity of system administrators
level: medium
license: DRL-1.1
related:
- id: f9b3edc5-3322-4fc7-8aa3-245d646cc4b7
type: derived