Skip to content

T1651 Cloud Administration Command

Adversaries may abuse cloud management services to execute commands within virtual machines or hybrid-joined devices. Resources such as AWS Systems Manager, Azure RunCommand, and Runbooks allow users to remotely run scripts in virtual machines by leveraging installed virtual machine agents. Similarly, in Azure AD environments, Microsoft Endpoint Manager allows Global or Intune Administrators to run scripts as SYSTEM on on-premises devices joined to the Azure AD.241

If an adversary gains administrative access to a cloud environment, they may be able to abuse cloud management services to execute commands in the environment’s virtual machines or on-premises hybrid-joined devices. Additionally, an adversary that compromises a service provider or delegated administrator account may similarly be able to leverage a Trusted Relationship to execute commands in connected virtual machines.3

Item Value
ID T1651
Tactics TA0002
Platforms Azure AD, IaaS
Version 1.0
Created 13 March 2023
Last Modified 14 April 2023

Procedure Examples

ID Name Description
S0677 AADInternals AADInternals can execute commands on Azure virtual machines using the VM agent.7
G0016 APT29 APT29 has used Azure Run Command and Azure Admin-on-Behalf-of (AOBO) to execute code on virtual machines.3


ID Mitigation Description
M1026 Privileged Account Management Limit the number of cloud accounts with permissions to remotely execute commands on virtual machines, and ensure that these are not used for day-to-day operations. In Azure, limit the number of accounts with the roles Azure Virtual Machine Contributer and above, and consider using temporary Just-in-Time (JIT) roles to avoid permanently assigning privileged access to virtual machines.5 In Azure AD, limit the number of Global and Intune administrators to only those required. In AWS, limit users with permission to execute the ssm:SendCommand action, and use tags to restrict the number of machines those users can execute commands on.6


ID Data Source Data Component
DS0017 Command Command Execution
DS0009 Process Process Creation
DS0012 Script Script Execution