Adversaries may abuse cloud management services to execute commands within virtual machines. Resources such as AWS Systems Manager, Azure RunCommand, and Runbooks allow users to remotely run scripts in virtual machines by leveraging installed virtual machine agents.[1],[2]
If an adversary gains administrative access to a cloud environment, they may be able to abuse cloud management services to execute commands in the environment’s virtual machines. Additionally, an adversary that compromises a service provider or delegated administrator account may similarly be able to leverage a Trusted Relationship to execute commands in connected virtual machines.[3]
References
- AWS. (n.d.). AWS Systems Manager Run Command. Retrieved March 13, 2023.
- Microsoft. (2023, March 10). Run scripts in your VM by using Run Command. Retrieved March 13, 2023.
- Microsoft Threat Intelligence Center. (2021, October 25). NOBELIUM targeting delegated administrative privileges to facilitate broader attacks. Retrieved March 25, 2022.
Linkitetyt tehtävät
- MITREATTACK -
EN: MITRE ATT&CK®, https://attack.mitre.org/. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. License: The MITRE Corporation (MITRE) hereby grants you a non-exclusive, royalty-free license to use ATT&CK® for research, development, and commercial purposes. Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. See the Terms of Use for the disclaimers. ATT&CK® is a registered trademark of The MITRE Corporation. Converted into the GRCA format.
DE: MITRE ATT&CK®, https://attack.mitre.org/. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE erlaubt die Nutzung für Forschung, Entwicklung und kommerzielle Zwecke, wenn jede Kopie den Urheberrechtsvermerk und die Lizenz enthält; maßgeblich ist der englische Wortlaut der Lizenz oben und die Terms of Use mit den Haftungsausschlüssen. ATT&CK® ist eine eingetragene Marke der MITRE Corporation. In das GRCA-Format umgewandelt.