Elastic Security Detection Rules

AWS SSM Agent Registered via Hybrid Activation

Last updated 2 months ago on 2026-09-14
Created 2 months ago on 2026-09-14

About

Identifies the Amazon SSM Agent invoked with "-register" and a hybrid activation argument on a Linux host. Hybrid activation is how non-EC2 hosts are onboarded as managed nodes, but adversaries with local access can repurpose the pre-installed, root-privileged SSM Agent as a covert remote access trojan by registering it to an attacker-controlled AWS account, gaining a persistent command channel that blends in with legitimate management traffic. On an EC2 instance that already runs the agent under an instance profile, a hybrid registration is highly unusual. The query cannot tell which account received the registration; the investigation guide explains how to confirm it.
Tags
Domain: EndpointDomain: CloudPlatform: AWSPlatform: LinuxOS: LinuxService: AWS SSMTactic: Command and ControlTactic: PersistenceData Source: Elastic DefendData Source: CrowdstrikeData Source: SentinelOneRule Type: Custom Query (KQL)Language: kuery
Severity
medium
Risk Score
47
MITRE ATT&CK™

Command and Control (TA0011)(external, opens in a new tab or window)

↳ Remote Access Tools (T1219)(external, opens in a new tab or window)

Persistence (TA0003)(external, opens in a new tab or window)

↳ External Remote Services (T1133)(external, opens in a new tab or window)

False Positive Examples
Hybrid activation is a legitimate operation when onboarding on-premises or non-EC2 hosts as managed nodes for the first time, and re-registration after an agent reinstall. De-registration ("-register -clear") does not match this rule. Add exceptions for known provisioning automation or onboarding hosts if this fires in expected environments.
License
Elastic License v2(external, opens in a new tab or window)

Definition

Rule Type
Query (Kibana Query Language)
Integration Pack
Prebuilt Security Detection Rules
Index Patterns
logs-endpoint.events.process*logs-crowdstrike.fdr*logs-sentinel_one_cloud_funnel.*
Related Integrations

endpoint(external, opens in a new tab or window)

crowdstrike(external, opens in a new tab or window)

sentinel_one_cloud_funnel(external, opens in a new tab or window)

Query
text code block:
event.category : process and host.os.type : linux and event.type : start and
event.action : (ProcessRollup2 or exec or exec_event or start) and
(
  process.name : (amazon-ssm-agent or ssm-agent-worker or ssm-setup-cli) or
  process.executable : (/snap/amazon-ssm-agent/*/amazon-ssm-agent or /usr/bin/amazon-ssm-agent or /usr/bin/ssm-setup-cli)
) and
process.args : (
  (-register or --register) and
  (
    -activation-code or -activation-code=* or --activation-code or --activation-code=* or
    -activation-id or -activation-id=* or --activation-id or --activation-id=* or
    -code or -code=* or --code or --code=* or
    -id or -id=* or --id or --id=*
  )
)

Install detection rules in Elastic Security

Detect AWS SSM Agent Registered via Hybrid Activation in the Elastic Security detection engine by installing this rule into your Elastic Stack.

To setup this rule, check out the installation guide for Prebuilt Security Detection Rules(external, opens in a new tab or window).