You must log in or register to comment.
Would be great if they went a bit more in detail how this exploit (?) works and how to defend against it. Is it a config error or just unsafe by default? Are you immediately at risk if you have the SSM agent running?
Are you immediately at risk if you have the SSM agent running?
No, this is a post-exploitation and used as a way to maintain persistence. Your machine will need to be comprimised in some form first.
The original post is so much better -> https://www.mitiga.io/blog/mitiga-security-advisory-abusing-the-ssm-agent-as-a-remote-access-trojan
