Skip to content

T1651 Cloud Administration Command

Adversaries may abuse cloud management services to execute commands within virtual machines or hybrid-joined devices. Resources such as AWS Systems Manager, Azure RunCommand, and Runbooks allow users to remotely run scripts in virtual machines by leveraging installed virtual machine agents. Similarly, in Azure AD environments, Microsoft Endpoint Manager allows Global or Intune Administrators to run scripts as SYSTEM on on-premises devices joined to the Azure AD.241

If an adversary gains administrative access to a cloud environment, they may be able to abuse cloud management services to execute commands in the environment’s virtual machines or on-premises hybrid-joined devices. Additionally, an adversary that compromises a service provider or delegated administrator account may similarly be able to leverage a Trusted Relationship to execute commands in connected virtual machines.3

Item Value
ID T1651
Sub-techniques
Tactics TA0002
Platforms Azure AD, IaaS
Version 1.0
Created 13 March 2023
Last Modified 14 April 2023

Procedure Examples

ID Name Description
S0677 AADInternals AADInternals can execute commands on Azure virtual machines using the VM agent.7
G0016 APT29 APT29 has used Azure Run Command and Azure Admin-on-Behalf-of (AOBO) to execute code on virtual machines.3

Mitigations

ID Mitigation Description
M1026 Privileged Account Management Limit the number of cloud accounts with permissions to remotely execute commands on virtual machines, and ensure that these are not used for day-to-day operations. In Azure, limit the number of accounts with the roles Azure Virtual Machine Contributer and above, and consider using temporary Just-in-Time (JIT) roles to avoid permanently assigning privileged access to virtual machines.5 In Azure AD, limit the number of Global and Intune administrators to only those required. In AWS, limit users with permission to execute the ssm:SendCommand action, and use tags to restrict the number of machines those users can execute commands on.6

Detection

ID Data Source Data Component
DS0017 Command Command Execution
DS0009 Process Process Creation
DS0012 Script Script Execution

References

  1. Andy Robbins. (2020, August 17). Death from Above: Lateral Movement from Azure to On-Prem AD. Retrieved March 13, 2023. ↩

  2. AWS. (n.d.). AWS Systems Manager Run Command. Retrieved March 13, 2023. ↩

  3. Microsoft Threat Intelligence Center. (2021, October 25). NOBELIUM targeting delegated administrative privileges to facilitate broader attacks. Retrieved March 25, 2022. ↩↩

  4. Microsoft. (2023, March 10). Run scripts in your VM by using Run Command. Retrieved March 13, 2023. ↩

  5. Adrien Bataille, Anders Vejlby, Jared Scott Wilson, and Nader Zaveri. (2021, December 14). Azure Run Command for Dummies. Retrieved March 13, 2023. ↩

  6. AWS. (n.d.). Setting up Run Command. Retrieved March 13, 2023. ↩

  7. Dr. Nestori Syynimaa. (2020, June 4). Getting root access to Azure VMs as a Azure AD Global Administrator. Retrieved March 13, 2023. ↩