Potential Amazon SSM Agent Hijacking via Registration
This rule detects attempts to hijack the Amazon SSM Agent by monitoring process creation events for the 'amazon-ssm-agent.exe' executable when it is launched with specific command-line arguments: '-register', '-code', '-id', and '-region'. This combination of arguments is indicative of an attacker attempting to register a compromised SSM Agent with a new AWS account or region, effectively turning it into a remote access trojan (RAT) as described in the referenced Mitiga research.
Sigma
