Adversaries may abuse cloud management services to execute commands within virtual machines. Resources such as AWS Systems Manager, Azure RunCommand, and Runbooks allow users to remotely run scripts in virtual machines by leveraging installed virtual machine agents. [1][2]
If an adversary gains administrative access to a cloud environment, they may be able to abuse cloud management services to execute commands in the environment’s virtual machines. Additionally, an adversary that compromises a service provider or delegated administrator account may similarly be able to leverage a Trusted Relationship to execute commands in connected virtual machines.[3]
| ID | Name | Description |
|---|---|---|
| S0677 | AADInternals |
AADInternals can execute commands on Azure virtual machines using the VM agent.[4] |
| G0016 | APT29 |
APT29 has used Azure Run Command and Azure Admin-on-Behalf-of (AOBO) to execute code on virtual machines.[3] |
| S1091 | Pacu |
Pacu can run commands on EC2 instances using AWS Systems Manager Run Command.[5] |
| ID | Mitigation | Description |
|---|---|---|
| M1026 | Privileged Account Management |
Limit the number of cloud accounts with permissions to remotely execute commands on virtual machines, and ensure that these are not used for day-to-day operations. In Azure, limit the number of accounts with the roles Azure Virtual Machine Contributer and above, and consider using temporary Just-in-Time (JIT) roles to avoid permanently assigning privileged access to virtual machines.[6] |
| ID | Name | Analytic ID | Analytic Description |
|---|---|---|---|
| DET0545 | Detection Strategy for Cloud Administration Command | AN1502 |
Monitor for suspicious use of cloud-native administrative command services (e.g., AWS Systems Manager Run Command, Azure RunCommand, GCP OS Config) to execute code inside VMs. Detect anomalies such as commands/scripts executed by unexpected users, execution outside of maintenance windows, or commands initiated by service accounts not normally tied to administration. Correlate cloud control-plane activity logs with host-level execution (process creation, script execution) to validate if commands materialized inside the guest OS. |