Linux Amazon SSM Agent Hijack Indicators via Suspicious Agent Registration Arguments

title: Linux Amazon SSM Agent Hijack Indicators via Suspicious Agent Registration Arguments
id: bee211c2-e75b-4eba-9cd2-0a48ceb5789d
status: test
description: This rule flags process executions where the binary path ends with /amazon-ssm-agent and the command line includes the full set of registration parameters (-register, -code, -id, and -region). Attackers can abuse the SSM agent to establish remote access and persist within a Linux environment by registering an unauthorized agent. The detection relies on Linux process creation telemetry containing the process image path and full command line arguments.
references:
  - https://www.mitiga.io/blog/mitiga-security-advisory-abusing-the-ssm-agent-as-a-remote-access-trojan
  - https://www.bleepingcomputer.com/news/security/amazons-aws-ssm-agent-can-be-used-as-post-exploitation-rat-malware/
  - https://www.helpnetsecurity.com/2023/08/02/aws-instances-attackers-access/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_ssm_agent_abuse.yml
author: Muhammad Faisal, Huntrule Team
date: 2023-08-03
tags:
  - attack.command-and-control
  - attack.persistence
  - attack.t1219.002
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    Image|endswith: /amazon-ssm-agent
    CommandLine|contains|all:
      - "-register "
      - "-code "
      - "-id "
      - "-region "
  condition: selection
falsepositives:
  - Legitimate activity of system administrators
level: medium
license: DRL-1.1
related:
  - id: f9b3edc5-3322-4fc7-8aa3-245d646cc4b7
    type: derived