AWS CreateAssociation
Creates an SSM State Manager association, binding a document to instances for persistent or scheduled command execution.
T1651: Cloud Administration Command
T1651: Cloud Administration Command
Adversaries may abuse cloud management services to execute commands within virtual machines. Resources such as AWS Systems Manager, Azure RunCommand, and Runbooks allow users to remotely run scripts in virtual machines by leveraging installed virtual machine agents.
View on MITRE ATT&CK →Azure Microsoft.Compute/virtualMachines/extensions/write
Installs or updates a VM extension on an Azure virtual machine, which can run scripts or install software agents.
Azure Microsoft.Compute/virtualMachines/runCommand/action
Executes a script or command on an Azure VM without requiring network-based access such as SSH or RDP.
Azure Microsoft.Compute/virtualMachines/write (CustomScriptExtension)
Creates or updates an Azure VM with a Custom Script Extension, executing a script on the VM at provisioning time.
AWS ResumeSession
Resumes a previously disconnected Systems Manager Session Manager session with a managed instance.
AWS SendCommand
Remotely executes a command or script on one or more managed instances via AWS Systems Manager Run Command.
AWS StartSession
Starts an interactive Systems Manager Session Manager session with a managed EC2 instance or on-premises server.