Detect Direct Cloud VM Connections in Google Chronicle

rule direct_cloud_vm_connection_t1021_008 {
  meta:
    author = "Detection Engineering"
    description = "Detects direct cloud VM connections via AWS SSM Session Manager, EC2 Instance Connect, and Azure Serial Console or Run Command (T1021.008)."
    mitre_attack_tactic = "Lateral Movement"
    mitre_attack_technique = "T1021.008"
    severity = "HIGH"
    priority = "HIGH"
    confidence = "HIGH"
    false_positives = "Authorized DevOps SSM usage, Azure automation extensions, CI/CD pipelines"

  events:
    $e.metadata.event_type = "USER_RESOURCE_ACCESS"
    $e.principal.user.userid != ""
    (
      (
        $e.metadata.vendor_name = "Amazon Web Services"
        and $e.metadata.product_name = "AWS CloudTrail"
        and $e.target.application in nocase (
          "ssm.amazonaws.com",
          "ec2-instance-connect.amazonaws.com"
        )
        and $e.metadata.product_event_type in nocase (
          "StartSession",
          "ResumeSession",
          "TerminateSession",
          "SendCommand",
          "StartAutomationExecution",
          "SendSSHPublicKey",
          "StartSSHSession"
        )
      )
      or
      (
        $e.metadata.vendor_name = "Microsoft"
        and $e.metadata.product_name = "Azure Activity"
        and (
          re.regex($e.target.resource.name, `(?i)VIRTUALMACHINES/RUNCOMMAND/ACTION`)
          or re.regex($e.target.resource.name, `(?i)SERIALCONSOLE/CONSOLESERVICES/ACCESS`)
          or re.regex($e.target.resource.name, `(?i)VIRTUALMACHINES/EXTENSIONS/WRITE`)
        )
      )
    )

  condition:
    $e
}