Technique.View on attack.mitre.org
Adversaries may abuse cloud management services to execute commands within virtual machines. Resources such as AWS Systems Manager, Azure RunCommand, and Runbooks allow users to remotely run scripts in virtual machines by leveraging installed virtual machine agents.
If an adversary gains administrative access to a cloud environment, they may be able to abuse cloud management services to execute commands in the environment’s virtual machines. Additionally, an adversary that compromises a service provider or delegated administrator account may similarly be able to leverage a Trusted Relationship to execute commands in connected virtual machines.
Rules on DetectionCode tagged with T1651.
None recorded.
| Used by | Procedure example |
|---|---|
| GroupAPT29 | APT29 has used Azure Run Command and Azure Admin-on-Behalf-of (AOBO) to execute code on virtual machines. |
| GroupVOID MANTICORE | VOID MANTICORE has abused built-in remote wipe or factory reset commands to wipe devices managed within an organization’s Cloud management solution impacting laptops, servers, and mobile devices. |
| Used by | Procedure example |
|---|---|
| ToolAADInternals | AADInternals can execute commands on Azure virtual machines using the VM agent. |
| ToolPacu | Pacu can run commands on EC2 instances using AWS Systems Manager Run Command. |
Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.
