T1021.008 — Direct Cloud VM Connections

Tactic: Lateral Movement · Platforms: IaaS

Adversaries may leverage Valid Accounts to log directly into accessible cloud hosted compute infrastructure through cloud native methods. Many cloud providers offer interactive connections to virtual infrastructure that can be accessed through the Cloud API, such as Azure Serial Console, AWS EC2…

Sub-technique of Remote Services (T1021).

Sigma detection rules (1)

T1021.008 Remote Services: Direct Cloud VM Connections

title: "T1021.008 Remote Services: Direct Cloud VM Connections"
id: 5b0850fe-5190-4350-9a39-ef4b9d964fd8
description: 'Detection of Direct VM Console Access via Cloud-Native Methods. (Data Component: Process Creation; baseline tier: windows-eventid.) Limited to AWS Systems Manager Session Manager process artifacts observable in-guest; Azure Serial Console and AWS EC2 Instance Connect Serial Console sessions occur at the hypervisor level and are not observable via Windows telemetry. Tune using: TimeWindow, CloudAuthMethod, SessionOriginRegion, TargetInstanceTags.'
references:
  - https://attack.mitre.org/techniques/T1021/008
author: Shahrukh Khan
date: 2026-06-29
license: MIT
tags:
  - attack.lateral-movement
  - attack.t1021.008

logsource:
  category: process_creation
  product: windows

detection:
  selection:
    Image|endswith:
      - '\ssm-agent-worker.exe'
      - '\ssm-session-worker.exe'

  condition: selection

falsepositives:
  - Legitimate AWS Systems Manager Session Manager administrative access on EC2 Windows instances.

level: medium

Related sub-techniques

Explore