ResumeSession

CSP: AWS

Tactics:

Lateral Movement Execution

Techniques:

T1021T1059

Tags:

AWS SSM

Event

Resumes a previously disconnected Systems Manager Session Manager session with a managed instance.

Security Context

• Remote command execution services provide adversaries with direct OS-level access to managed instances, often without requiring SSH or RDP.
• Using remote services for lateral movement allows adversaries to pivot between systems while leveraging legitimate access mechanisms.

Log Source

CloudTrail

Sample Event

MITRE ATT&CK Mapping

Tactics: Lateral Movement Execution

Techniques:

• T1021 — Remote Services — Adversaries may use Valid Accounts to log into a service that accepts remote connections, such as telnet, SSH, and VNC. The adversary may then perform actions as the logged-on user.
• T1059 — Command and Scripting Interpreter — Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms.