AWS SSM Run Command Executed on EC2 Instance

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•3

This rule detects when an AWS Systems Manager (SSM) Run Command is executed on an EC2 instance. It specifically looks for HTTP traffic to 'ssm.amazonaws.com' with the URI containing 'SendCommand'. This indicates an attempt to remotely execute commands on an EC2 instance via AWS SSM.