AWS CreateAssociation
Creates a Systems Manager State Manager association.
T1651: Cloud Administration Command
T1651: Cloud Administration Command
Adversaries may abuse cloud management services to execute commands within virtual machines. Resources such as AWS Systems Manager, Azure RunCommand, and Runbooks allow users to remotely run scripts in virtual machines by leveraging installed virtual machine agents.
View on MITRE ATT&CK →Azure Microsoft.Compute/virtualMachines/extensions/write
Creates or updates an extension on an Azure virtual machine.
Azure Microsoft.Compute/virtualMachines/runCommand/action
Requests script execution through Azure VM Action Run Command.
AWS ResumeSession
Reconnects to a disconnected SSM Session Manager session.
AWS SendCommand
Submits an SSM Run Command document to managed nodes.
AWS StartSession
Starts an SSM Session Manager session.