You do not always need a network path to a server to log into it in the cloud. Providers offer interactive connections to virtual machines through their management APIs. That is useful for administrators and equally useful for someone who has stolen their credentials.
MITRE tracks this as Direct Cloud VM Connections, technique T1021.008, under Lateral Movement. The platform is IaaS.
How attackers use it
MITRE names several native options: Azure Serial Console, AWS EC2 Instance Connect and AWS Systems Manager. Authentication can use passwords, application access tokens or SSH keys.
The notable detail is the level of access. MITRE says these methods may, by default, allow privileged access on the host at SYSTEM or root level. They typically give direct console access to the VM, as opposed to running scripts through the cloud administration command route, which is a separate technique.
So an adversary with valid cloud credentials can skip firewalls, security groups and bastion hosts that you built to control SSH and RDP, and land straight on a machine.
How to detect it
MITRE's strategy (DET0211) describes direct login to cloud-hosted VMs through cloud-native methods such as EC2 Instance Connect, Azure Serial Console or Systems Manager, followed by command execution or privilege escalation on the VM.
That gives you two data sets to join:
- Cloud audit logs, which record who opened a console or session, from where, and when.
- Host logs, which show what ran on the machine right after.
Alert when the person is not one who normally administers that machine, when the session comes at an odd hour, or when it lands on a system that has no routine need for interactive access.
How to reduce the risk
MITRE lists two mitigations.
- Limit which users can reach compute infrastructure through cloud-native methods. Use account and role permissions so only the people who need it can open a console or session.
- Disable the connection types you do not use, where the platform lets you.
Check your own environment
- List which of these native connection methods are enabled in each cloud account and each subscription.
- List the identities and roles that are allowed to use them. Remove the ones that are there out of habit.
- Confirm that session and console access events reach your central logging.
- Check whether any VM image grants root or SYSTEM access through these methods by default, and whether that is intended.
- Review whether an automated inventory of your cloud assets would show you every VM that can be reached this way.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Why can direct cloud VM connections bypass network controls?
They go through the cloud provider's management API rather than a network path you control, so security groups and bastion hosts built for SSH or RDP may never see the connection.
What two mitigations does MITRE list?
Limit which users may access compute infrastructure through cloud-native methods, and disable those connection types where they are not needed for administration.
Sources
- MITRE ATT&CK, Direct Cloud VM Connections (T1021.008)
