Remote Services: Direct Cloud VM Connections `T1021.008`

Tactic: Lateral Movement

Adversaries may leverage Valid Accounts to log directly into accessible cloud hosted compute infrastructure through cloud native methods. Many cloud providers offer interactive connections to virtual infrastructure that can be accessed through the Cloud API, such as Azure Serial Console, AWS EC2 Instance Connect, and AWS System Manager..

Events covered

6 catalog events are tagged with this technique by at least one rule.

Provider	Event	Title
Defender-DeviceFileEvents	any	File activity
Defender-DeviceFileEvents	FileCreated	File created
Defender-DeviceNetworkEvents	ConnectionSuccess	Connection succeeded
Defender-DeviceNetworkEvents	ConnectionFailed	Connection failed
Defender-DeviceNetworkEvents	ConnectionRequest	Connection request
Defender-DeviceNetworkEvents	ConnectionAttempt	Connection attempt

Authoring guide

These 5 rules share fields, values, and exclusions.

Fields filtered most (15 distinct)

These fields appear most often in rule filters.

Field	Rules	How	Sample values
`ActionType`	2	`eq` 2, `in` 1	`FileCreated`, `connectionattempt`, `connectionfailed`
`parent_process_name`	2	`eq` 2	`customscripthandler.exe`
`CategoryValue`	1	`eq` 1	`Administrative`
`DestinationPort`	1	`in` 1	`135`, `22`, `3389`
`EventMessage`	1	`contains` 1	`extensions/write`, `runcommand/action`
`FileType`	1	`contains` 1	`executable`
`FirstTimeUserPerformedAction`	1	`eq` 1	`True`
`azure.activitylogs.identity.authorization.evidence.principal_id`	1	`is_not_null` 1
`azure.activitylogs.operation_name`	1	`eq` 1	`microsoft.serialconsole/serialports/connect/action`
`azure_ad::operation_name_value`	1	`eq` 1	`microsoft.compute/virtualmachines/extensions/write`, `microsoft.compute/virtualmachines/runcommand/action`
`data_stream.dataset`	1	`eq` 1	`azure.activitylogs`
`event.outcome`	1	`eq` 1	`success`
`file_name`	1	`contains` 1	`.bat`, `.cmd`, `.com`
`sha256`	1	`is_not_null` 1
`source.as.number`	1	`is_not_null` 1

Top indicator values (33 distinct)

These values appear most often in rule predicates.

Field	Kind	Value	Rules (here)	Corpus reach
`ActionType`	`eq`	`FileCreated` kustoDetect executable drops via Azure custom script extension kustoDetect process drops via Azure Custom Script Extension performing lateral movement	2	7
`parent_process_name`	`eq`	`customscripthandler.exe` kustoDetect executable drops via Azure custom script extension kustoDetect process drops via Azure Custom Script Extension performing lateral movement	2	2
`ActionType`	`in`	`connectionattempt` kustoDetect process drops via Azure Custom Script Extension performing lateral movement	1	2
`ActionType`	`in`	`connectionfailed` kustoDetect process drops via Azure Custom Script Extension performing lateral movement	1	2
`ActionType`	`in`	`connectionrequest` kustoDetect process drops via Azure Custom Script Extension performing lateral movement	1	2
`ActionType`	`in`	`connectionsuccess` kustoDetect process drops via Azure Custom Script Extension performing lateral movement	1	2
`CategoryValue`	`eq`	`Administrative` kustoDetect Custom Script or Run Command deployment by risky user	1
`DestinationPort`	`in`	`135` kustoDetect process drops via Azure Custom Script Extension performing lateral movement	1	4
`DestinationPort`	`in`	`22` kustoDetect process drops via Azure Custom Script Extension performing lateral movement	1	5
`DestinationPort`	`in`	`3389` kustoDetect process drops via Azure Custom Script Extension performing lateral movement	1	5
`DestinationPort`	`in`	`445` kustoDetect process drops via Azure Custom Script Extension performing lateral movement	1	10
`DestinationPort`	`in`	`5900` kustoDetect process drops via Azure Custom Script Extension performing lateral movement	1	3
`DestinationPort`	`in`	`5985` kustoDetect process drops via Azure Custom Script Extension performing lateral movement	1	5
`DestinationPort`	`in`	`5986` kustoDetect process drops via Azure Custom Script Extension performing lateral movement	1	5
`EventMessage`	`contains`	`extensions/write` kustoDetect first time Azure Custom Script or Run Command deployment	1
`EventMessage`	`contains`	`runcommand/action` kustoDetect first time Azure Custom Script or Run Command deployment	1
`FileType`	`contains`	`executable` kustoDetect executable drops via Azure custom script extension	1
`FirstTimeUserPerformedAction`	`eq`	`True` kustoDetect first time Azure Custom Script or Run Command deployment	1
`azure.activitylogs.operation_name`	`eq`	`microsoft.serialconsole/serialports/connect/action` elasticAzure VM Serial Console Connection with Unusual User and ASN	1
`azure_ad::operation_name_value`	`eq`	`microsoft.compute/virtualmachines/extensions/write` kustoDetect Custom Script or Run Command deployment by risky user	1
`azure_ad::operation_name_value`	`eq`	`microsoft.compute/virtualmachines/runcommand/action` kustoDetect Custom Script or Run Command deployment by risky user	1	4
`data_stream.dataset`	`eq`	`azure.activitylogs` elasticAzure VM Serial Console Connection with Unusual User and ASN	1	39
`event.outcome`	`eq`	`success` elasticAzure VM Serial Console Connection with Unusual User and ASN	1	375
`file_name`	`contains`	`.bat` kustoDetect executable drops via Azure custom script extension	1	2
`file_name`	`contains`	`.cmd` kustoDetect executable drops via Azure custom script extension	1	2
`file_name`	`contains`	`.com` kustoDetect executable drops via Azure custom script extension	1	2
`file_name`	`contains`	`.cpl` kustoDetect executable drops via Azure custom script extension	1	2
`file_name`	`contains`	`.dll` kustoDetect executable drops via Azure custom script extension	1	2
`file_name`	`contains`	`.exe` kustoDetect executable drops via Azure custom script extension	1	2
`file_name`	`contains`	`.msi` kustoDetect executable drops via Azure custom script extension	1

Remote Services: Direct Cloud VM Connections `T1021.008`

Events covered

Authoring guide

Fields filtered most (15 distinct)

Top indicator values (33 distinct)

Rules under this technique

Elastic 1 rule

Kusto 4 rules

Remote Services: Direct Cloud VM Connections T1021.008

Events covered

Authoring guide

Fields filtered most (15 distinct)

Top indicator values (33 distinct)

Rules under this technique

Elastic 1 rule

Kusto 4 rules

Remote Services: Direct Cloud VM Connections `T1021.008`