Techniques › T1021.008 › AN0594
AN0594 Analytic 0594
IaaS · attack.mitre.org · ATT&CK Enterprise v19.2
<p>Direct login to cloud-hosted virtual machines via cloud-native access methods (e.g., EC2 Instance Connect, Azure Serial Console, SSM), followed by command execution or privilege escalation on the VM</p>
- Detects
- T1021.008 Direct Cloud VM Connections
- Part of
- DET0211 Detection of Direct VM Console Access via Cloud-Native Methods
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| AWS:CloudTrail | SendSSHPublicKey, StartSession (SSM), EC2InstanceConnect | DC0067 Logon Session Creation |
| WinEventLog:Sysmon | EventCode=1 | DC0032 Process Creation |
Mutable elements
Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.
| Field | Description |
|---|---|
TimeWindow | Correlates cloud login to host activity within a reasonable time span (e.g., < 60 seconds) |
CloudAuthMethod | Filters based on access vector: SSH key, SSM session, or Console connect |
SessionOriginRegion | Identifies sessions from out-of-region or untrusted networks |
TargetInstanceTags | Filters sensitive systems or production assets for alert tuning |