{"id":"T1021.008","name":"Direct Cloud VM Connections","url":"https://attack.mitre.org/techniques/T1021/008","tactics":["lateral-movement"],"platforms":["IaaS"],"live":true,"revoked":false,"deprecated":false,"revoked_by":null,"detection_strategies":[{"id":"DET0211","stix_id":"x-mitre-detection-strategy--f40c0c98-76fe-4e2a-970a-0491f52a9a47","name":"Detection of Direct VM Console Access via Cloud-Native Methods","url":"https://attack.mitre.org/detectionstrategies/DET0211","analytics":[{"id":"AN0594","stix_id":"x-mitre-analytic--926f4550-8c47-4882-afb3-1f0832c8d3b9","name":"Analytic 0594","description":"Direct login to cloud-hosted virtual machines via cloud-native access methods (e.g., EC2 Instance Connect, Azure Serial Console, SSM), followed by command execution or privilege escalation on the VM","url":"https://attack.mitre.org/detectionstrategies/DET0211#AN0594","platforms":["IaaS"],"log_source_references":[{"name":"AWS:CloudTrail","channel":"SendSSHPublicKey, StartSession (SSM), EC2InstanceConnect","data_component":"DC0067","data_component_name":"Logon Session Creation","log_source_slug":"aws-cloudtrail"},{"name":"WinEventLog:Sysmon","channel":"EventCode=1","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"wineventlog-sysmon"}],"mutable_elements":[{"field":"TimeWindow","description":"Correlates cloud login to host activity within a reasonable time span (e.g., < 60 seconds)"},{"field":"CloudAuthMethod","description":"Filters based on access vector: SSH key, SSM session, or Console connect"},{"field":"SessionOriginRegion","description":"Identifies sessions from out-of-region or untrusted networks"},{"field":"TargetInstanceTags","description":"Filters sensitive systems or production assets for alert tuning"}],"live":true,"detection_strategies":["DET0211"],"techniques":["T1021.008"]}],"live":true,"version":"1.0","techniques":["T1021.008"]}],"sigma_rules":[],"kev_cves":[],"_built":"2026-08-24 19:45 UTC","_attack_version":"19.2","_sigma_commit":"da9bb07d642a2826e89702445d32c795209ec108"}