AN1502 Analytic 1502

IaaS · attack.mitre.org · ATT&CK Enterprise v19.2

<p>Monitor for suspicious use of cloud-native administrative command services (e.g., AWS Systems Manager Run Command, Azure RunCommand, GCP OS Config) to execute code inside VMs. Detect anomalies such as commands/scripts executed by unexpected users, execution outside of maintenance windows, or commands initiated by service accounts not normally tied to administration. Correlate cloud control-plane activity logs with host-level execution (process creation, script execution) to validate if commands materialized inside the guest OS.</p>

Detects: T1651 Cloud Administration Command
Part of: DET0545 Detection Strategy for Cloud Administration Command

Log sources and channels

Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.

Log source	Channel	Data component
AWS:CloudTrail	`SendCommand, StartSession, ExecuteCommand: Unexpected AWS Systems Manager command execution targeting EC2 instances`	DC0064 Command Execution
azure:activity	`Microsoft.Compute/virtualMachines/runCommand/action: Abnormal initiation of Azure RunCommand jobs or PowerShell/Bash payloads`	DC0029 Script Execution
azure:vmguest	`Unexpected execution of cloud agent processes (e.g., WindowsAzureGuestAgent.exe, ssm-agent) followed by arbitrary script or binary execution`	DC0032 Process Creation

Mutable elements

Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.

Field	Description
`UserContext`	Differentiate between known admin/service accounts and non-administrative users triggering RunCommand or SSM.
`TimeWindow`	Correlate cloud control-plane API calls with host-side execution events within a bounded timeframe (e.g., 5 minutes).
`AllowedScripts`	Whitelist approved scripts or automation invoked via RunCommand to reduce false positives.