T1651 · Cloud Administration Command · MITRE ATT&CK

Cloud Administration Command MITRE reference T1651

56th pctamong all ATT&CK techniques for number of groups

2 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.

VOID MANTICOREG1055 ↗

Has abused built-in remote wipe or factory reset commands to wipe devices managed within an organization’s Cloud management solution impacting laptops, servers, and mobile devices.1

created 2026-04-201 referenceaka COBALT MYSTIQUE

APT29G0016 ↗

Has used Azure Run Command and Azure Admin-on-Behalf-of (AOBO) to execute code on virtual machines.1

created 2017-05-311 referenceaka IRON RITUAL

All 2 groups for this technique

Offense vs defense T1651

Compare defenses against adversary use. Eight counts, ranking this technique against the entire ATT&CK Enterprise matrix. Attack sits left, defense right.

Cloud Administration Command detection strategy DET0545

MITRE names one behaviour worth catching for this technique and breaks it into 1 analytic, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Detection Strategy for Cloud Administration Command

Enterprise

1 platform

AN1502 · IaaS

Monitor for suspicious use of cloud-native administrative command services (e.g., AWS Systems Manager Run Command, Azure RunCommand, GCP OS Config) to execute code inside VMs. Detect anomalies such as commands/scripts executed by unexpected users, execution outside of maintenance windows, or commands initiated by service accounts not normally tied to administration. Correlate cloud control-plane activity logs with host-level execution (process creation, script execution) to validate if commands materialized inside the guest OS.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Script ExecutionDC0029	azure:activity	Microsoft.Compute/virtualMachines/runCommand/action: Abnormal initiation of Azure RunCommand jobs or PowerShell/Bash payloads
Process CreationDC0032	azure:vmguest	Unexpected execution of cloud agent processes (e.g., WindowsAzureGuestAgent.exe, ssm-agent) followed by arbitrary script or binary execution
Command ExecutionDC0064	AWS:CloudTrail	SendCommand, StartSession, ExecuteCommand: Unexpected AWS Systems Manager command execution targeting EC2 instances

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
UserContext	Differentiate between known admin/service accounts and non-administrative users triggering RunCommand or SSM.
TimeWindow	Correlate cloud control-plane API calls with host-side execution events within a bounded timeframe (e.g., 5 minutes).
AllowedScripts	Whitelist approved scripts or automation invoked via RunCommand to reduce false positives.

Tests1Executorspowershell 1Need elevation0 of 1Have prerequisites1Have cleanup0Platformsiaas:aws

# Test Platform Executor Elevation Prereqs Cleanup Ref

01 AWS Run Command (and Control) iaas:aws powershell — 2 —

This test simulates an adversary using the AWS Run Command service to execute commands on EC2 instances.

Inputs

Name	Description	Type	Default Value
region	AWS region to deploy the EC2 instance	string	us-east-2
profile	AWS profile	string
access_key	AWS Access Key	string
secret_key	AWS Secret Key	string
session_token	AWS Session Token	string

Attack Commandsrun with powershell

Import-Module "PathToAtomicsFolder/T1651/src/T1651-1/AWSSSMAttack.ps1" -Force
$access_key = "#{access_key}"
$secret_key = "#{secret_key}"
$session_token = "#{session_token}"
$aws_profile = "#{profile}"
$region = "#{region}"
Set-AWSAuthentication -AccessKey $access_key -SecretKey $secret_key -SessionToken $session_token -AWSProfile $aws_profile -AWSRegion $region
Invoke-Terraform -TerraformCommand init -TerraformDirectory "PathToAtomicsFolder/T1651/src/T1651-1"
Invoke-Terraform -TerraformCommand apply -TerraformDirectory "PathToAtomicsFolder/T1651/src/T1651-1" -TerraformVariables @("profile=T1651-1", "region=$region")
Invoke-SSMAttack -AWSProfile "T1651-1" -TerraformDirectory "PathToAtomicsFolder/T1651/src/T1651-1"
Invoke-Terraform -TerraformCommand destroy -TerraformDirectory "PathToAtomicsFolder/T1651/src/T1651-1" -TerraformVariables @("profile=T1651-1", "region=$region")

Dependenciesrun with powershell

Description

The AWS PowerShell module must be installed.

Check Prereq Commands

try {if (Get-InstalledModule -Name AWSPowerShell -ErrorAction SilentlyContinue) {exit 0} else {exit 1}} catch {exit 1}

Get Prereq Commands

Install-Module -Name AWSPowerShell -Force

Description

Terraform must be installed.

Check Prereq Commands

terraform --version

Get Prereq Commands

Write-Host "Terraform is required. Download it from https://www.terraform.io/downloads.html"

GUIDa3cc9c95-c160-4b86-af6f-84fba87bfd30

Tests from Atomic Red Team (MIT licence) · technique definition

Cloud Administration Command detections T1651

No detection rules are mapped to this technique yet.

None recorded— 32% of ATT&CK techniques have none either

No matching rules

Drag headers to reorder | Drag edges to resize

Select	Title	Description	Category	Status	Event	OS	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs
No rules found. Try adjusting your filters.

Cloud Administration Command T1651

Cloud Administration Command T1651

Cloud Administration Command MITRE reference T1651

Offense vs defense T1651

Cloud Administration Command detection strategy DET0545

Detection Strategy for Cloud Administration Command

Log sources

Tunable fields

Cloud Administration Command MITRE reference T1651

Offense vs defense T1651

Cloud Administration Command detection strategy DET0545

Detection Strategy for Cloud Administration Command

Log sources

Tunable fields

Cloud Administration Command detections T1651

Cloud Administration Command detections T1651