Cloud Threat Landscape
  • Incidents
  • Actors
  • Techniques
  • Defenses
  • Tools
  • Targeted Technologies
  • Posters & Newspapers
  • About
  • RSS
  • STIX
  • Back to wiz.io
Cloud Threat Landscape

SSM-facilitated remote desktop connection

Tags
Cloud
ATT&CK Tactic
Lateral Movement (TA0008)
Last edited
Sep 22, 2024 10:09 AM
Status
Stub
Defenses
IAM Policies

Attackers can abuse an EC2 instance's role to call the AWS Systems Manager (SSM) API in order to run commands on a remote EC2 instance if its managed by SSM.

Made with 💙 by Wiz

Last Updated: April 3, 2025