More on Abusing the Amazon Web Services SSM Agent as a Remote Access Trojan

Originally published by Mitiga. Written by Ariel Szarf and Or Aspir. Imagine that you’re a SOC (Security Operations Center) analyst receiving an alert about suspicious behavior from a binary on an EC2 instance. After checking the binary on VirusTotal, you find it was an AWS-developed software signed by Amazon. Further investigation reveals that it communicated only with Amazon-owned IP addresses. Now you're faced with a decision to determine your next course of action. Will you continue inves...

abusing access agent alert amazon amazon web services analyst aws binary center ec2 find instance mitiga operations remote access remote access trojan security security operations security operations center services soc software ssm suspicious behavior trojan virustotal web web services written