AWS SSM Agent hybrid activation abuse as a covert remote-access channel
An adversary with local access re-registers the pre-installed, root-privileged SSM Agent to an attacker-controlled account via a hybrid activation, turning it into remote access that blends with admin tooling
categoryCloud, container and supply chain attacksseverityHighlabnot yet measured
Example: Elastic rule 'AWS SSM Agent Registered via Hybrid Activation' (created 2026-09-14): amazon-ssm-agent / ssm-agent-worker / ssm-setup-cli run with -register and an activation code or ID on Linux
Classification
32 values: 32 machine-classified. What do these mean?
Exploitability
| Attack vector | Post-compromise / campaignMisconfiguration |
|---|---|
| Reach (CVSS) | Local |
| Attack complexity | Low |
| Attack requirements | Present |
| Privileges required | High |
| User interaction | None |
| Attacker skill required | Medium |
| Resources required | Low |
| Network required | Yes |
| Likelihood / prevalence | Low |
| Maturity | Established |
Impact & scope
| Severity | High |
|---|---|
| Impact | ConfidentialityIntegrity |
| Platform | LinuxIaaS |
| Environment | CloudHybrid |
| Target asset class | Server |
| Kill-chain phase (tactic) | PersistenceCommand and Control |
| Remote support | Yes |
Detection & telemetry
| Noise level | Low |
|---|---|
| Data sources (ATT&CK data components) | Process CreationCommand Execution |
| Log sources | auditd:EXECVEedr:telemetryAWS:CloudTrail |
| Defense bypassed | FirewallEDR / behavioural monitoring |
| Attack permissions (ATT&CK) | root |
Detection & response
Mitigated by 2
Framework references
- Primary source: https://github.com/elastic/detection-rules/commit/f64a763410c6effd743ea221614ec64c8f33c5c3
- attack: T1219 (primary)
- attack: T1133
Evidence & sources
- ev-0001 ([New Rule] AWS SSM Agent Registered via Hybrid Activation (elastic/detection-rules)) — Rule matches Linux process starts of amazon-ssm-agent, ssm-agent-worker or ssm-setup-cli with -register / --register plus an activation code or ID argument; hybrid registration on an EC2 instance already running the agent is highly unusual
- ev-0002 ([New Rule] AWS SSM Agent Registered via Hybrid Activation (elastic/detection-rules)) — Rule maps to T1219 Remote Access Tools and T1133 External Remote Services; documented false positives are first-time hybrid onboarding, re-registration after reinstall and provisioning automation; de-registration (-register -clear) does not match