ssm

Author: carlospolop

src/SUMMARY.md

@@ -230,7 +230,7 @@
     - [AWS - SNS Persistence](pentesting-cloud/aws-security/aws-persistence/aws-sns-persistence.md)
     - [AWS - Secrets Manager Persistence](pentesting-cloud/aws-security/aws-persistence/aws-secrets-manager-persistence.md)
     - [AWS - SQS Persistence](pentesting-cloud/aws-security/aws-persistence/aws-sqs-persistence.md)
-    - [AWS - SSM Perssitence](pentesting-cloud/aws-security/aws-persistence/aws-ssm-perssitence.md)
+    - [AWS - SSM Perssitence](pentesting-cloud/aws-security/aws-persistence/aws-ssm-persistence.md)
     - [AWS - Step Functions Persistence](pentesting-cloud/aws-security/aws-persistence/aws-step-functions-persistence.md)
     - [AWS - STS Persistence](pentesting-cloud/aws-security/aws-persistence/aws-sts-persistence.md)
   - [AWS - Post Exploitation](pentesting-cloud/aws-security/aws-post-exploitation/README.md)

src/pentesting-cloud/aws-security/aws-persistence/aws-ssm-perssitence.md renamed to src/pentesting-cloud/aws-security/aws-persistence/aws-ssm-persistence.md

@@ -12,7 +12,7 @@ For more information check:
 
 ### Using ssm:CreateAssociation for persistence
 
-An attacker with the permission ssm:CreateAssociation can create a State Manager Association to automatically execute commands on EC2 instances managed by SSM. These associations can be configured to run at a fixed interval, making them suitable for backdoor-like persistence without interactive sessions.
+An attacker with the permission **`ssm:CreateAssociation`** can create a State Manager Association to automatically execute commands on EC2 instances managed by SSM. These associations can be configured to run at a fixed interval, making them suitable for backdoor-like persistence without interactive sessions.
 
 
 ```bash

src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-ssm-privesc.md

@@ -121,6 +121,23 @@ aws ssm get-command-invocation --command-id <cmd_id> --instance-id <i_id>
 
 **Potential Impact:** Find sensitive information inside the output of the command lines.
 
+### Using ssm:CreateAssociation
+
+An attacker with the permission **`ssm:CreateAssociation`** can create a State Manager Association to automatically execute commands on EC2 instances managed by SSM. These associations can be configured to run at a fixed interval, making them suitable for backdoor-like persistence without interactive sessions.
+
+
+```bash
+aws ssm create-association \
+  --name SSM-Document-Name \
+  --targets Key=InstanceIds,Values=target-instance-id \
+  --parameters commands=["malicious-command"] \
+  --schedule-expression "rate(30 minutes)" \
+  --association-name association-name
+```
+
+> [!NOTE]
+> This persistence method works as long as the EC2 instance is managed by Systems Manager, the SSM agent is running, and the attacker has permission to create associations. It does not require interactive sessions or explicit ssm:SendCommand permissions. **Important:** The `--schedule-expression` parameter (e.g., `rate(30 minutes)`) must respect AWS's minimum interval of 30 minutes. For immediate or one-time execution, omit `--schedule-expression` entirely — the association will execute once after creation.
+
 ### Codebuild
 
 You can also use SSM to get inside a codebuild project being built:

src/pentesting-cloud/aws-security/aws-services/aws-ec2-ebs-elb-ssm-vpc-and-vpn-enum/README.md

@@ -200,6 +200,14 @@ In the following page you can check how to **abuse SSM permissions to escalate p
 ../../aws-privilege-escalation/aws-ssm-privesc.md
 {{#endref}}
 
+### Perssistence
+
+In the following page you can check how to **abuse SSM permissions to achieve persistence**:
+
+{{#ref}}
+../../aws-persistence/aws-ssm-persistence.md
+{{#endref}}
+
 ## ELB
 
 **Elastic Load Balancing** (ELB) is a **load-balancing service for Amazon Web Services** (AWS) deployments. ELB automatically **distributes incoming application traffic** and scales resources to meet traffic demands.