Cloud Service Used for Internal Lateral Movement

Darshan Thummar@Mighty

•updated Jun 12, 2026•0•0•6

This rule detects attempts to use cloud services (specifically AWS SSM or Azure Management) for internal lateral movement. It triggers when HTTP requests are made to 'ssm.amazonaws.com' or 'management.azure.com' with the URI containing 'SendCommand'. A threshold of 5 such events from the same source within 30 seconds is set to reduce false positives.