T1651 — Cloud Administration Command

Tactic: Execution · Platforms: IaaS

Adversaries may abuse cloud management services to execute commands within virtual machines. Resources such as AWS Systems Manager, Azure RunCommand, and Runbooks allow users to remotely run scripts in virtual machines by leveraging installed virtual machine agents. If an adversary gains…

Sigma detection rules (1)

T1651 Cloud Administration Command

title: T1651 Cloud Administration Command
id: 5e42833a-db42-4824-a609-5609f3dac283
description: 'Detection Strategy for Cloud Administration Command. (Retargeted to the cloudtrail AWS telemetry that actually captures this techniques behavior; see logsource below.) Tune using: UserContext, TimeWindow, AllowedScripts.'
references:
  - https://attack.mitre.org/techniques/T1651
author: Shahrukh Khan
date: 2026-04-03
license: MIT
tags:
  - attack.execution
  - attack.t1651

logsource:
  category: cloudtrail
  product: aws

detection:
  selection:
    eventSource: 'ssm.amazonaws.com'
    eventName: 'SendCommand'

  condition: selection

falsepositives:
  - Scheduled patch management or configuration compliance jobs executing an approved SSM document.

level: high

Explore