MITRE ATT&CK Technique
T1651Cloud Administration Command
- First Reported
- Sep 14, 2026
- Latest Reported
- Sep 29, 2026
Official Description
Adversaries may abuse cloud management services to execute commands within virtual machines. Resources such as AWS Systems Manager, Azure RunCommand, and Runbooks allow users to remotely run scripts in virtual machines by leveraging installed virtual machine agents. (Citation: AWS Systems Manager Run Command)(Citation: Microsoft Run Command)
If an adversary gains administrative access to a cloud environment, they may be able to abuse cloud management services to execute commands in the environment’s virtual machines. Additionally, an adversary that compromises a service provider or delegated administrator account may similarly be able to leverage a [Trusted Relationship](https://attack.mitre.org/techniques/T1199) to execute commands in connected virtual machines.(Citation: MSTIC Nobelium Oct 2021)
If an adversary gains administrative access to a cloud environment, they may be able to abuse cloud management services to execute commands in the environment’s virtual machines. Additionally, an adversary that compromises a service provider or delegated administrator account may similarly be able to leverage a [Trusted Relationship](https://attack.mitre.org/techniques/T1199) to execute commands in connected virtual machines.(Citation: MSTIC Nobelium Oct 2021)
- Tactics
- Execution
- Platforms
- IaaS
- MITRE Version
- 2.1
- Last Modified
- May 12, 2026
Reported Context (2)
- The attacker used SSM SendCommand against a production EC2 instance identified in the article as a Windows domain controller. Wiz Blue Agent Traces AWS and GitHub Data Exfiltration Attack
- The appendix maps the “AWS SSM send command attempt” alert to this technique. Researchers Map AWS Identity Behavior to Improve Cloud Threat Detection
MITRE ATT&CK (13)
Vendors (3)
Products (17)
Tools (7)
Countries (2)
Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.