Adversaries may abuse cloud management services to execute commands within virtual machines. Resources such as AWS Systems Manager, Azure RunCommand, and Runbooks allow users to remotely run scripts in virtual machines by leveraging installed virtual machine agents. (Citation: AWS Systems Manager Run Command)(Citation: Microsoft Run Command)

If an adversary gains administrative access to a cloud environment, they may be able to abuse cloud management services to execute commands in the environment’s virtual machines. Additionally, an adversary that compromises a service provider or delegated administrator account may similarly be able to leverage a [Trusted Relationship](https://attack.mitre.org/techniques/T1199) to execute commands in connected virtual machines.(Citation: MSTIC Nobelium Oct 2021)
Cloud Administration Command
source_name: mitre-attack  url: https://attack.mitre.org/techniques/T1651  external_id: T1651     source_name: AWS Systems Manager Run Command  description: AWS. (n.d.). AWS Systems Manager Run Command. Retrieved March 13, 2023.  url: https://docs.aws.amazon.com/systems-manager/latest/userguide/run-command.html     source_name: MSTIC Nobelium Oct 2021  description: Microsoft Threat Intelligence Center. (2021, October 25). NOBELIUM targeting delegated administrative privileges to facilitate broader attacks. Retrieved March 25, 2022.  url: https://www.microsoft.com/security/blog/2021/10/25/nobelium-targeting-delegated-administrative-privileges-to-facilitate-broader-attacks/     source_name: Microsoft Run Command  description: Microsoft. (2023, March 10). Run scripts in your VM by using Run Command. Retrieved March 13, 2023.  url: https://learn.microsoft.com/en-us/azure/virtual-machines/run-command-overview     