tfMITRE ATT&CK technique

Cloud Administration Command T1651

Tactic: Execution
Platform: IaaS
Version: 2.1
Created: 13 March 2023
Last modified: 12 May 2026
Contributors: Cisco; Nichols Jasper; Jared Wilson; Caio Silva; Adrien Bataille; Anders Vejlby; Nader Zaveri; Tamir Yehuda

Adversaries may abuse cloud management services to execute commands within virtual machines. Resources such as AWS Systems Manager, Azure RunCommand, and Runbooks allow users to remotely run scripts in virtual machines by leveraging installed virtual machine agents. [1][2]

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groups56th pct

Threat groups56th percentile · 56% of ATT&CK techniques have this many threat groups attributed or fewer.

CampaignsNone recorded

CampaignsNone recorded · 54% of ATT&CK techniques have none either.

Tools & malware51st pct

Tools & malware51st percentile · 51% of ATT&CK techniques have this many tools implementing them or fewer.

Detection rulesNone recorded

Detection rulesNone recorded · 33% of ATT&CK techniques have none either.

Cloud Administration Command MITRE reference T1651

56th pctamong all ATT&CK techniques for number of groups

2 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.

VOID MANTICOREG1055 ↗

Has abused built-in remote wipe or factory reset commands to wipe devices managed within an organization’s Cloud management solution impacting laptops, servers, and mobile devices.1

created 2026-04-201 referenceaka COBALT MYSTIQUE

APT29G0016 ↗

Has used Azure Run Command and Azure Admin-on-Behalf-of (AOBO) to execute code on virtual machines.1

created 2017-05-311 referenceaka IRON RITUAL

All 2 groups for this technique

Offense vs defense T1651

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

Cloud Administration Command detection strategy DET0545

MITRE names one behaviour worth catching for this technique and breaks it into 1 analytic, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Detection Strategy for Cloud Administration Command

Enterprise

1 platform

AN1502 · IaaS

Monitor for suspicious use of cloud-native administrative command services (e.g., AWS Systems Manager Run Command, Azure RunCommand, GCP OS Config) to execute code inside VMs. Detect anomalies such as commands/scripts executed by unexpected users, execution outside of maintenance windows, or commands initiated by service accounts not normally tied to administration. Correlate cloud control-plane activity logs with host-level execution (process creation, script execution) to validate if commands materialized inside the guest OS.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Script ExecutionDC0029	azure:activity	Microsoft.Compute/virtualMachines/runCommand/action: Abnormal initiation of Azure RunCommand jobs or PowerShell/Bash payloads
Process CreationDC0032	azure:vmguest	Unexpected execution of cloud agent processes (e.g., WindowsAzureGuestAgent.exe, ssm-agent) followed by arbitrary script or binary execution
Command ExecutionDC0064	AWS:CloudTrail	SendCommand, StartSession, ExecuteCommand: Unexpected AWS Systems Manager command execution targeting EC2 instances

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
UserContext	Differentiate between known admin/service accounts and non-administrative users triggering RunCommand or SSM.
TimeWindow	Correlate cloud control-plane API calls with host-side execution events within a bounded timeframe (e.g., 5 minutes).
AllowedScripts	Whitelist approved scripts or automation invoked via RunCommand to reduce false positives.

Tests1ExecutorsPowerShell 1Need elevation0 of 1Have prerequisites1Have cleanup0Platformsiaas:aws

Test

Platform

Executor

Elevation

Prereqs

Cleanup

Ref

AWS Run Command (and Control)

iaas:aws

PowerShell

—

This test simulates an adversary using the AWS Run Command service to execute commands on EC2 instances.

Input arguments

Name	Type	Default	Description
region	string	us-east-2	AWS region to deploy the EC2 instance
profile	string		AWS profile
access_key	string		AWS Access Key
secret_key	string		AWS Secret Key
session_token	string		AWS Session Token

Attack command

Import-Module "PathToAtomicsFolder/T1651/src/T1651-1/AWSSSMAttack.ps1" -Force
$access_key = "#{access_key}"
$secret_key = "#{secret_key}"
$session_token = "#{session_token}"
$aws_profile = "#{profile}"
$region = "#{region}"
Set-AWSAuthentication -AccessKey $access_key -SecretKey $secret_key -SessionToken $session_token -AWSProfile $aws_profile -AWSRegion $region
Invoke-Terraform -TerraformCommand init -TerraformDirectory "PathToAtomicsFolder/T1651/src/T1651-1"
Invoke-Terraform -TerraformCommand apply -TerraformDirectory "PathToAtomicsFolder/T1651/src/T1651-1" -TerraformVariables @("profile=T1651-1", "region=$region")
Invoke-SSMAttack -AWSProfile "T1651-1" -TerraformDirectory "PathToAtomicsFolder/T1651/src/T1651-1"
Invoke-Terraform -TerraformCommand destroy -TerraformDirectory "PathToAtomicsFolder/T1651/src/T1651-1" -TerraformVariables @("profile=T1651-1", "region=$region")

Prerequisite

The AWS PowerShell module must be installed.

Check

try {if (Get-InstalledModule -Name AWSPowerShell -ErrorAction SilentlyContinue) {exit 0} else {exit 1}} catch {exit 1}

Satisfy

Install-Module -Name AWSPowerShell -Force

Prerequisite

Terraform must be installed.

Check

terraform --version

Satisfy

Write-Host "Terraform is required. Download it from https://www.terraform.io/downloads.html"

GUIDd55a3ebd-77f2-489c-af69-23b49edee319

Tests from Atomic Red Team (MIT licence) · technique definition

Cloud Administration Command detections T1651

No detection rules are mapped to this technique yet.

None recorded— 33% of ATT&CK techniques have none either

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs