Windows Amazon SSM Agent Process Creation with Registration and Code Parameters
Alerts on amazon-ssm-agent.exe starting with -register, -code, -id, and -region parameters on Windows.
- Product
- windows
- Category
- process_creation
- Author
- Muhammad Faisal (SigmaHQ), DRL 1.1
- Published
- 2023-08-02
- Updated
- 2026-07-30
ATT&CK techniques
C2Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
Exfiltration
Impact
What it detects
This rule flags process executions where the Windows binary amazon-ssm-agent.exe is launched with command-line arguments consistent with agent registration and code/id/region provisioning. Attackers may leverage this to establish remote access by hijacking the SSM agent workflow, making this behavior important for early detection and triage. It relies on Windows process creation telemetry, specifically the executable path and the presence of required command-line parameters.
Reporting behind it
- mitiga.iohttps://www.mitiga.io/blog/mitiga-security-advisory-abusing-the-ssm-agent-as-a-remote-access-trojan
- bleepingcomputer.comhttps://www.bleepingcomputer.com/news/security/amazons-aws-ssm-agent-can-be-used-as-post-exploitation-rat-malware/
- helpnetsecurity.comhttps://www.helpnetsecurity.com/2023/08/02/aws-instances-attackers-access/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_ssm_agent_abuse.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows Amazon SSM Agent Process Creation with Registration and Code Parameters
id: d1e1e903-32de-4f9c-bb4e-9e727498d081
status: test
description: This rule flags process executions where the Windows binary amazon-ssm-agent.exe is launched with command-line arguments consistent with agent registration and code/id/region provisioning. Attackers may leverage this to establish remote access by hijacking the SSM agent workflow, making this behavior important for early detection and triage. It relies on Windows process creation telemetry, specifically the executable path and the presence of required command-line parameters.
references:
- https://www.mitiga.io/blog/mitiga-security-advisory-abusing-the-ssm-agent-as-a-remote-access-trojan
- https://www.bleepingcomputer.com/news/security/amazons-aws-ssm-agent-can-be-used-as-post-exploitation-rat-malware/
- https://www.helpnetsecurity.com/2023/08/02/aws-instances-attackers-access/
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_ssm_agent_abuse.yml
author: Muhammad Faisal, Huntrule Team
date: 2023-08-02
tags:
- attack.command-and-control
- attack.persistence
- attack.t1219.002
logsource:
category: process_creation
product: windows
detection:
selection:
Image|endswith: \amazon-ssm-agent.exe
CommandLine|contains|all:
- "-register "
- "-code "
- "-id "
- "-region "
condition: selection
falsepositives:
- Legitimate activity of system administrators
level: medium
license: DRL-1.1
related:
- id: d20ee2f4-822c-4827-9e15-41500b1fff10
type: derived