Detect Direct Cloud VM Connections in CrowdStrike LogScale
Adversaries may leverage Valid Accounts to log directly into cloud-hosted virtual infrastructure using cloud-native connection methods. Cloud providers offer interactive console access to VMs that bypasses traditional network controls: Azure Serial Console, AWS EC2 Instance Connect, AWS Systems Manager Session Manager (SSM), and GCP OS Login. These methods authenticate via the cloud IAM layer rather than network credentials, can bypass firewall rules and security groups, and often provide SYSTEM or root-level access by default. Adversaries who compromise cloud IAM credentials can pivot to VM instances using these native APIs, even when SSH/RDP is blocked at the network level.
MITRE ATT&CK
- Tactic
- Lateral Movement
- Technique
- T1021 Remote Services
- Sub-technique
- T1021.008 Direct Cloud VM Connections
- Canonical reference
- https://attack.mitre.org/techniques/T1021/008/
LogScale Detection Query
// CrowdStrike LogScale: Detect cloud-native VM connection events from ingested AWS CloudTrail
// and Azure Activity logs, plus Falcon sensor signals for SSM agent process activity
// Branch 1: AWS CloudTrail events ingested into LogScale
#repo=cloudtrail
| eventSource = /ssm\.amazonaws\.com|ec2-instance-connect\.amazonaws\.com/
| eventName = /^(StartSession|ResumeSession|TerminateSession|SendCommand|StartAutomationExecution|SendSSHPublicKey|StartSSHSession)$/
| eval CloudProvider = "AWS"
| eval ActorIdentity = userIdentity.arn
| eval TargetVM = coalesce(requestParameters.target, requestParameters.instanceId)
| eval SourceIP = sourceIPAddress
| eval AlertType = "AWS_DirectVMConnection"
| table([_time, CloudProvider, ActorIdentity, eventName, eventSource, TargetVM, SourceIP, AlertType])
// Branch 2: Azure Activity logs ingested into LogScale
// Uncomment and union if Azure logs are in a separate repo
// #repo=azureactivity
// | operationName.value = /RUNCOMMAND\/ACTION|SERIALCONSOLE\/CONSOLESERVICES\/ACCESS|EXTENSIONS\/WRITE/i
// | eval CloudProvider = "Azure"
// | eval ActorIdentity = caller
// | eval TargetVM = resourceId
// | eval SourceIP = httpRequest.clientIpAddress
// | eval AlertType = "Azure_DirectVMConnection"
// | table([_time, CloudProvider, ActorIdentity, operationName.value, TargetVM, SourceIP, AlertType])
// Branch 3: Falcon sensor — SSM agent or EC2 instance connect process spawned on endpoint
// Detects adversary-controlled SSM agent or shell sessions initiated from cloud console
// #event_simpleName=ProcessRollup2
// | CommandLine = /amazon-ssm-agent|ssm-session-worker|ec2-instance-connect|ssm-agent/i
// | groupBy([ComputerName, UserName, FileName, CommandLine, ParentBaseFileName],
// function=[count(as=EventCount), min(_time, as=FirstSeen), max(_time, as=LastSeen)])
// | sort(EventCount, order=desc)CrowdStrike LogScale (Humio) detection for T1021.008 covering three signal sources. Branch 1 queries AWS CloudTrail logs ingested into a LogScale repo, filtering for SSM and EC2 Instance Connect session and command initiation events. Branch 2 (commented) covers Azure Activity logs if ingested into a separate repo. Branch 3 (commented) uses Falcon ProcessRollup2 sensor telemetry to detect SSM agent processes spawned on endpoints, which can indicate cloud-console-initiated sessions on instances running the CrowdStrike agent. The #repo tag must match your LogScale repository naming convention. Enrich alerts with AWS account ID from the recipientAccountId field and the AWS region from awsRegion for high-fidelity triage. For CrowdStrike Falcon Horizon (CSPM) users, additional cloud IOA detections may surface this activity via the Falcon UI without custom LogScale queries.
Data Sources
Required Tables
False Positives & Tuning
- AWS Systems Manager agents running legitimately on managed instances will generate SSM session telemetry during routine patch baselines, inventory collection runs, or compliance document execution initiated by authorized automation accounts.
- Security operations tooling such as AWS Security Hub automated remediation actions or third-party CSPM platforms using SSM SendCommand to quarantine compromised instances or collect forensic artifacts.
- Developers using AWS SSM Session Manager port-forwarding as a secure tunnel for local development database access or service debugging on private-subnet instances, which generates StartSession events indistinguishable from interactive shell access.
Other platforms for T1021.008
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1AWS SSM Send Command to EC2 Instance
Expected signal: AWS CloudTrail event: eventName=SendCommand, eventSource=ssm.amazonaws.com, with instanceId, documentName, and parameters. CloudWatch Log stream for the command output (if session logging enabled). Source IP address recorded in CloudTrail.
- Test 2AWS EC2 Instance Connect (Temporary SSH Key Injection)
Expected signal: AWS CloudTrail: SendSSHPublicKey event from ec2-instance-connect.amazonaws.com with instanceId, osUser, and publicKey fingerprint. Subsequent SSH connection attempt to the instance.
- Test 3Azure Run Command on VM
Expected signal: Azure Activity Log: MICROSOFT.COMPUTE/VIRTUALMACHINES/RUNCOMMAND/ACTION operation by the executing identity. The script content is visible in the Properties field. Source IP recorded in httpRequest.clientIpAddress.
- Test 4Start AWS SSM Session Manager Interactive Session
Expected signal: AWS CloudTrail: StartSession event from ssm.amazonaws.com with target instanceId, sessionId, and caller identity. Session logs in CloudWatch if session logging enabled. Note: interactive session content is only captured if session logging is configured.
References (7)
- https://attack.mitre.org/techniques/T1021/008/
- https://learn.microsoft.com/en-us/troubleshoot/azure/virtual-machines/serial-console-overview
- https://docs.aws.amazon.com/systems-manager/latest/userguide/session-manager.html
- https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/Connect-using-EC2-Instance-Connect.html
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1021.008/T1021.008.md
- https://www.mandiant.com/resources/blog/sim-swapping-and-abuse-of-the-microsoft-azure-serial-console
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-320a
Unlock Pro Content
Get the full detection package for T1021.008 including response playbook, investigation guide, and atomic red team tests.