T1651Techniqueexecutionagent-callable

T1651Cloud Administration Command

Platforms: IaaS

ATT&CK version: v19.1

What it is

Adversaries may abuse cloud management services to execute commands within virtual machines. Resources such as AWS Systems Manager, Azure RunCommand, and Runbooks allow users to remotely run scripts in virtual machines by leveraging installed virtual machine agents. (Citation: AWS Systems Manager Run Command)(Citation: Microsoft Run Command) If an adversary gains administrative access to a cloud environment, they may be able to abuse cloud management services to execute commands in the environment’s virtual machines. Additionally, an adversary that compromises a service provider or delegated administrator account may similarly be able to leverage a [Trusted Relationship](https://attack.mitre.org/techniques/T1199) to execute commands in connected virtual machines.(Citation: MSTIC Nobelium Oct 2021)

ATT&CK tactics· 1

Execution

References

  1. https://attack.mitre.org/techniques/T1651
  2. https://docs.aws.amazon.com/systems-manager/latest/userguide/run-command.html
  3. https://www.microsoft.com/security/blog/2021/10/25/nobelium-targeting-delegated-administrative-privileges-to-facilitate-broader-attacks/
  4. https://learn.microsoft.com/en-us/azure/virtual-machines/run-command-overview
Sourced from MITRE ATT&CK Enterprise v14.1. Curated and contextualized for EU compliance use cases by Adam Lundqvist, Founder at SQUR.
T1651: Cloud Administration Command | SQUR Knowledge Base