AWS SSM Session Manager Used for Lateral Movement

Darshan Thummar@Mighty

•updated Jun 12, 2026•0•0•4

This rule detects network traffic where an HTTP request is made to 'ssm.amazonaws.com' with the URI containing 'StartSession'. This combination indicates the initiation of an AWS Systems Manager (SSM) Session Manager session, which can be used for legitimate remote administration but also for lateral movement by attackers.