Detection Strategies DET0211 — Detection of Direct VM Console Access via Cloud-Native Methods

DET0211

Detection of Direct VM Console Access via Cloud-Native Methods

1 analytic(s) · 1 technique(s) detected

Analytics

AN0594 Analytic 0594

IaaS

Direct login to cloud-hosted virtual machines via cloud-native access methods (e.g., EC2 Instance Connect, Azure Serial Console, SSM), followed by command execution or privilege escalation on the VM

AWS:CloudTrail SendSSHPublicKey, StartSession (SSM), EC2InstanceConnect WinEventLog:Sysmon EventCode=1

[TimeWindow] Correlates cloud login to host activity within a reasonable time span (e.g., < 60 seconds)

[CloudAuthMethod] Filters based on access vector: SSH key, SSM session, or Console connect

[SessionOriginRegion] Identifies sessions from out-of-region or untrusted networks

[TargetInstanceTags] Filters sensitive systems or production assets for alert tuning

Detected Techniques

Lateral Movement (1)

T1021.008 Direct Cloud VM Connections

Details

MITRE ID: DET0211
STIX ID: x-mitre-detection-strategy--f40c0c98-76fe-4e2a-970a-0491f52a9a47
Analytics: 1
Techniques Detected: 1
By Tactic