AWS SSM Agent Abused as a Living-off-the-Land Remote Access Trojan via Hybrid-Activation Hijacking and Parallel Agent Processes
AWS SSM Agent Abused as a Living-off-the-Land Remote Access (TL-2026-1709), also tracked as SSM Agent as RAT, is a medium-severity cloud security threat, first published 2026-07-26. It has no confirmed attribution, affects Amazon Web Services AWS Systems Manager (SSM) Agent, maps to 12 MITRE ATT&CK techniques (T1021, T1036, T1059), and is covered by 9 detection rules and 21 indicators of compromise.
Key facts for TL-2026-1709
- Threat ID
- TL-2026-1709
- Also known as
- SSM Agent as RAT, SSM-as-RAT, AWS SSM Agent Hijacking, Amazon SSM Agent Living-off-the-Land
- Severity
- MEDIUM
- Status
- ACTIVE
- Category
- CLOUD
- First published
- 2026-07-26
- Last reviewed
- 2026-07-26
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Detection rules
- 9
- Indicators of compromise
- 21
Malware and tooling in AWS SSM Agent Abused as a Living-off-the-Land Remote Access
Malware and tooling: ssm-as-rat
Mitiga researchers demonstrate how an attacker who already holds root/administrator access on an EC2 instance or on-prem/hybrid host can repurpose the legitimate, pre-installed, Amazon-signed AWS Systems Manager (SSM) Agent as a stealthy Remote Access Trojan — either by re-registering it to an attacker-controlled AWS account via hybrid activation, or by running a second, hidden SSM agent process alongside the legitimate one — giving persistent, trusted-binary C2 without deploying any separate malware.
How AWS SSM Agent Abused as a Living-off-the-Land Remote Access works
AWS Systems Manager (SSM) Agent is a signed, first-party Amazon binary pre-installed on most Amazon Linux, Ubuntu, Windows Server, and (on EC2) macOS images, and is commonly installed on-prem and in other clouds via 'hybrid activation' for centralized fleet management. Because it is trusted, digitally signed, and frequently excluded from EDR/AV inspection, Mitiga researchers (building on 2019 and January 2021 prior work by cloudonaut.io and Nick Frichette) show it can be weaponized as a Remote Access Trojan by an attacker who already has initial code execution and root/administrator privileges.
Two exploitation scenarios are documented. Scenario 1 (Agent Hijacking) re-registers the already-installed SSM Agent to an attacker-owned AWS account using AWS Systems Manager's legitimate hybrid-activation workflow: the attacker generates an activation code/ID pair in their own account (CreateActivation), stops the local agent, runs it with '-register -code <ACTIVATION_CODE> -id <ACTIVATION_ID> -region <REGION>', and restarts it — after which the agent reports to and executes RunCommand/StartSession commands from the attacker's account instead of (or in addition to) the victim's, over normal-looking HTTPS/WSS traffic to ec2messages/ssmmessages endpoints. Scenario 2 (Parallel/Hidden Agent) runs a second SSM agent process alongside the legitimate one so the original registration and connectivity are left undisturbed: on Linux this is done either via a Linux namespace (copy agent files to an alternate path, 'unshare' into a new mount namespace, mount the alternate copy over the original path) requiring elevated-but-not-necessarily-root privileges, or via the agent's container-mode configuration flag (adjusts credential-source order to bypass the ECS metadata service, works without sudo, but is restricted to the 'Start Session' capability only); on Windows, environment variables are set to redirect the agent's configuration lookup to an attacker-controlled alternate storage location, preserving 'Run Command' access.
Both scenarios avoid dropping any new malware: all execution occurs through the trusted, Amazon-signed amazon-ssm-agent binary, so file-hash/signature-based and application-allowlisting controls do not flag it, and traffic blends into expected AWS Systems Manager network flows. The technique requires no CVE — AWS confirmed it as intended (if under-hardened) product behavior rather than a vulnerability requiring a patch, after Mitiga privately disclosed it. A public proof-of-concept toolkit (github.com/mitiga/ssm-as-rat) demonstrates both scenarios. The Mitiga writeup was substantively updated on 2026-07-22, four days before this hunt, indicating continued relevance and likely refreshed guidance (organization-wide SSM command-output logging to S3/CloudWatch, scrutiny of CreateActivation events, and VPC Endpoint restriction) that keeps the technique live for defenders in 2026.
MITRE ATT&CK techniques used in TL-2026-1709
Lateral Movement
T1021 Remote Services; T1570 Lateral Tool Transfer
Defense Evasion
T1036 Masquerading; T1078 Valid Accounts; T1218 System Binary Proxy Execution
Execution
T1059 Command and Scripting Interpreter
Command and Control
T1071 Application Layer Protocol; T1090 Proxy; T1102 Web Service; T1219 Remote Access Tools
Persistence
T1078 Valid Accounts; T1543 Create or Modify System Process
Resource Development
Affected products and versions in AWS SSM Agent Abused as a Living-off-the-Land Remote Access
- Amazon Web Services — AWS Systems Manager (SSM) Agent
Vulnerable versions: Amazon Linux 2017.09+; Amazon Linux 2; Amazon Linux 2023; SLES 12/15; Ubuntu 16.04/18.04/20.04; Windows Server 2008–2022 (post-November 2016 builds); macOS 10.14.x–11.x (EC2 only)
Fixed in: None — no software fix exists; mitigated via IAM/network/detection controls, not by patching the agent
Remediation for AWS SSM Agent Abused as a Living-off-the-Land Remote Access
Patches
- No vendor patch exists or is expected — AWS classifies this as abuse of intended hybrid-activation/agent functionality rather than a vulnerability, and confirmed the finding without assigning a CVE.
Immediate actions
- Audit Systems Manager hybrid-activation (CreateActivation) events across the organization; legitimate use is narrow, so any unexpected occurrence warrants investigation.
- Enumerate instance-metadata directories on hosts (/var/lib/amazon/ssm/i-<id> on Linux, C:\ProgramData\Amazon\SSM\InstanceData\i-<id> on Windows) for more than one instance-ID directory, indicating possible hijacking.
- Enumerate running hosts for more than one concurrent amazon-ssm-agent / amazon-ssm-agent.exe process, indicating a possible parallel hidden agent.
- Remove the SSM agent binary from EDR/antivirus trusted-process allow-lists so behavioral detection is not bypassed by its Amazon code-signature.
- Alert on process execution of amazon-ssm-agent (or amazon-ssm-agent.exe) with command-line flags '-register -code -id -region'.
Workarounds
- Where SSM Agent is not operationally required (e.g., certain on-prem or hardened hosts), remove or disable it to eliminate the trusted-binary abuse surface entirely.
Longer-term hardening
- Deploy VPC Endpoints (PrivateLink) for Systems Manager, ec2messages, and ssmmessages with restrictive endpoint policies that only permit the account's own SSM service principals.
- Restrict StartSession and SendCommand execution to principals within the originating AWS account/organization via IAM condition policies (aws:PrincipalOrgID / aws:SourceAccount).
- Enable organization-wide SSM command-output logging with S3 bucket and CloudWatch Logs configured as defaults for all SendCommand executions, so RunCommand activity cannot be silently unlogged.
- Integrate the Sigma detections (SigmaHQ 'Potential Linux/Windows Amazon SSM Agent Hijacking') and CloudTrail anomaly rules for StartSession/SendCommand/CreateActivation into SIEM/SOAR for continuous hunting.
- Apply least-privilege IAM policies that restrict which principals may create hybrid activations or modify SSM agent registration.
Timeline of AWS SSM Agent Abused as a Living-off-the-Land Remote Access
- cloudonaut.io publishes 'AWS SSM is a Trojan Horse, Fix it Now!', an early warning about SSM Agent's over-privileged default IAM policy and root-level command execution reach.
- Nick Frichette (frichetten.com) publishes 'SSM Agent Tomfoolery' (circa January 2021), reverse-engineering the SSM binary protocol to demonstrate EC2 message interception and session-hijacking with compromised IAM credentials — foundational research Mitiga's 2023 work builds on.
- Mitiga publishes 'Abusing the Amazon Web Services SSM Agent as a Remote Access Trojan', detailing agent-hijacking (hybrid activation) and parallel/hidden-agent scenarios; research was shared with AWS's security team ahead of publication, and the accompanying 'ssm-as-rat' PoC toolkit is released on GitHub.
- Mainstream security press (BleepingComputer, CSO Online, Help Net Security, The Hacker News) covers the research, amplifying awareness of SSM Agent's RAT potential across the industry.
- SigmaHQ community detection rules 'Potential (Linux/Windows) Amazon SSM Agent Hijacking' are published by author Muhammad Faisal, matching amazon-ssm-agent process execution with '-register -code -id -region' command-line flags.
- Cloud Security Alliance republishes and amplifies the Mitiga research as a member advisory.
- Mitiga substantively updates the original blog post, indicating the technique and its detection/mitigation guidance remain actively relevant in 2026.
- TL-Intel-Harness flags the updated Mitiga article during RSS hunt sweep as a continued-relevance living-off-the-land technique with a public PoC, opening threat TL-2026-1709.
Sources cited for AWS SSM Agent Abused as a Living-off-the-Land Remote Access
- More on Abusing the Amazon Web Services SSM Agent as a Remote Access Trojan
- AWS SSM Agent source code
- ssm-as-rat proof-of-concept scripts
- Security Advisory: Abusing the SSM Agent as a Remote Access Trojan
- More on Abusing the Amazon Web Services SSM Agent as a Remote Access Trojan (CSA republish)
- SSM Agent Tomfoolery
- AWS SSM is a Trojan Horse, Fix it Now!
- Potential Linux Amazon SSM Agent Hijacking (Sigma rule)
- Potential Amazon SSM Agent Hijacking (Sigma rule, Windows)
- Amazon's AWS SSM agent can be used as post-exploitation RAT malware
- Researchers warn Amazon's AWS System Manager agent can be used as a RAT
- Attackers can turn AWS SSM agents into remote access trojans
- Researchers Uncover AWS SSM Agent Misuse as a Covert Remote Access Trojan
- Deciphering the Risks of AWS SSM in Hybrid Environments
Threats related to AWS SSM Agent Abused as a Living-off-the-Land Remote Access
Detection coverage for TL-2026-1709
As of 2026-07-26, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1709 across Splunk SPL, Microsoft KQL and Sigma, covering 21 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.