Process spawned inside an AWS SSM interactive session

Siemphony@siemphonylowT1021.008unverifiedPlaybook · Lateral movement

Matches a process created with ssm-session-worker.exe as its parent — the AWS Systems Manager Agent's per-session worker, spawned only for an interactive Session Manager connection and not for Run Command document execution. AN0594 names three cloud-native console methods; the other two, Azure Serial Console and EC2 Instance Connect, leave no artifact in the single Windows process_creation logsource this brief offers, so only the SSM path is written. The shell or command that follows is the "command execution on the VM" half of the analytic; the login/auth half and the region/tag context in MITRE's knobs live in the cloud control plane, not the guest OS, so they are not attempted here. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0211, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 4 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

1title: Process spawned inside an AWS SSM interactive session2id: 3a5fbce5-c9c9-4539-a2d7-21c56e000e323status: experimental4description: |5  Matches a process created with ssm-session-worker.exe as its parent — the6  AWS Systems Manager Agent's per-session worker, spawned only for an7  interactive Session Manager connection and not for Run Command document8  execution. AN0594 names three cloud-native console methods; the other two,9  Azure Serial Console and EC2 Instance Connect, leave no artifact in the10  single Windows process_creation logsource this brief offers, so only the SSM11  path is written. The shell or command that follows is the "command execution12  on the VM" half of the analytic; the login/auth half and the region/tag13  context in MITRE's knobs live in the cloud control plane, not the guest OS,14  so they are not attempted here.15  UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0211, not hand-written and not tested by its author. Any lab result is on this rule's own page.16references:17  - https://attack.mitre.org/techniques/T1021/00818  - https://attack.mitre.org/detectionstrategies/DET021119author: Siemphony pipeline (machine-derived from MITRE ATT&CK v19.2)20date: 2026-08-1621tags:22  - attack.lateral-movement23  - attack.t1021.00824logsource:25  category: process_creation26  product: windows27detection:28  selection:29    ParentImage|endswith: '\ssm-session-worker.exe'30  condition: selection31falsepositives:32  - "Sanctioned administrative access. Many AWS estates standardise on SSM Session Manager specifically to avoid opening RDP or SSH, so this event is the normal shape of legitimate interactive administration on any account where that policy is in force."33  - "Automated patching, backup or maintenance runbooks that open an SSM session, including port-forwarding sessions, to run scheduled scripts — appearing as this same parent/child pair at a predictable time and from a service identity."34  - "Break-glass emergency access used precisely because it needs no open SSH or RDP port after a bastion outage or credential rotation, indistinguishable here from unauthorized use since this event carries no IAM principal."35level: low

Sentinel · KQL

Run this as a search.

DeviceProcessEvents| where InitiatingProcessFolderPath endswith "\\ssm-session-worker.exe"

Splunk · SPL

Run this as a search.

index=* ParentImage="*\\ssm-session-worker.exe"

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE TO_LOWER(process.parent.executable) LIKE "*\\\\ssm-session-worker.exe"

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,windows,process_creation,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <rule id="100000" level="5">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="ParentImage" type="pcre2">(?i)\\ssm-session-worker\.exe$</field>    <description>Process spawned inside an AWS SSM interactive session</description>    <mitre>      <id>T1021.008</id>    </mitre>  </rule></group>

At a glance

Logsource: process_creation / windows
Level: low
Category: lateral_movement_remote_exec
Sigma status: experimental
Backends: 4 of 4 rendered
Updated: 30 Aug 2026
Rule ID: 3a5fbce5-c9c9-4539-a2d7-21c56e000e32

ATT&CKT1021.008

T1021.008Direct Cloud VM Connections

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Evidence

Verification1 run

Not verified

Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Noise check0 of 30 fired

Fires on none of the 30 ordinary behaviours the baseline holds for this log type. That is not a precision guarantee: it means only not caught by these 30 behaviours, and the next ordinary behaviour nobody wrote down may still match.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1021.008, evaluated against their process_creation events.

Using it

Tuning & false positivesexperimental · 3 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

Given the coverage gap, the biggest tuning move isn't inside this rule at all: add companion detections against CloudTrail (StartSession) and Azure Activity Log for the Instance Connect and Serial Console legs AN0594 also names, since this rule structurally cannot see them. Within this rule, cut noise by joining ParentImage hits against a known-admin identity list or expected maintenance windows if your SIEM supports post-hoc correlation — MITRE's SessionOriginRegion and TargetInstanceTags knobs are good candidates for that join, populated with your own region allowlist and production-tag list, values the rule author would supply, not MITRE.

Declared by the author

Sanctioned administrative access. Many AWS estates standardise on SSM Session Manager specifically to avoid opening RDP or SSH, so this event is the normal shape of legitimate interactive administration on any account where that policy is in force.
Automated patching, backup or maintenance runbooks that open an SSM session, including port-forwarding sessions, to run scheduled scripts — appearing as this same parent/child pair at a predictable time and from a service identity.
Break-glass emergency access used precisely because it needs no open SSH or RDP port after a bastion outage or credential rotation, indistinguishable here from unauthorized use since this event carries no IAM principal.

Lessonlateral movement remote exec

lateral movement remote execAI draft — unreviewed

01 · What this rule detects

This rule catches one specific artifact of AWS Systems Manager (SSM) Session Manager: a process whose parent is ssm-session-worker.exe, the SSM Agent's per-session worker, spawned only for an interactive Session Manager connection (not for Run Command, which spawns ssm-document-worker.exe instead). MITRE's AN0594 names three cloud-native console methods — EC2 Instance Connect, Azure Serial Console, and AWS SSM — but the brief supplies only one Windows process_creation logsource, so only the SSM leg is observable here. The other two leave no artifact in this feed.

02 · Telemetry you need

Sysmon EventID 1 (logsource: category: process_creation, product: windows) on the guest VM, with ParentImage populated. This is standard Sysmon process-creation logging — Sysmon must be installed and configured to log EID 1, but no extra audit policy is required beyond that.

03 · How the logic works

There is a single selection: ParentImage|endswith: '\ssm-session-worker.exe', condition selection. Nothing correlates it to a cloud-side login event, a time window, a region, or a tag. MITRE's mutableElements for AN0594 name four knobs — TimeWindow, CloudAuthMethod, SessionOriginRegion, TargetInstanceTags — and none of them are implemented in this rule. That is not an oversight: lib/sigma in this corpus has no aggregation or timeframe support, so "correlate cloud login to host activity within 60 seconds" cannot be expressed as Sigma selection logic at all. This rule is precursor-only — it captures the guest-OS fragment (the child process spawned inside the session), while the login/auth half and all four tuning knobs live in the cloud control plane (CloudTrail, Azure Activity Log), a different logsource this brief doesn't offer.

04 · Common false positives

The rule's own first false positive says it plainly: SSM Session Manager is often the sanctioned way organizations avoid opening RDP/SSH at all, so this event is the normal shape of legitimate administration wherever that policy is in force — which is why level: low. Scheduled patching and backup runbooks that open SSM sessions to run scripts produce the identical parent/child pair from a service identity. One entry deserves a closer look: the third false positive ("break-glass emergency access... indistinguishable here from unauthorized use since this event carries no IAM principal") was flagged by review as blending two different things — a genuine benign source (emergency access) with a detection limitation (no IAM principal visible in this logsource). AUTHORING.md is explicit that limitations belong in the rule's description, not the falsepositives list, because a false positive has to name something that would actually match, not explain what the rule cannot see. Read that entry as one honest benign source with a limitation riding along, not two independent false positives.

05 · Detection maturity

tier_1: UNVERIFIED — lowest tier. This rule has never been run against real data: there is no hit count, no false-positive rate, and no confirmed detection to cite for it. Treat it as a starting scaffold to validate against your own SSM session logs before trusting the low severity or any of the false-positive framing above.

Related detections3 nearby

Ranked by how alike the detection logic reads, computed offline. Proximity is not evidence — each of these carries its own verification state on its own page.

Share this rule

/u/siemphony/3a5fbce5-c9c9-4539-a2d7-21c56e000e32

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

Process spawned inside an AWS SSM interactive session

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Community

Verdicts from engineers who deployed it