AWS SSM Session Manager Child Process Execution

event.category: "process" and event.action : ("exec" or "exec_event" or "start" or "ProcessRollup2" or "executed" or "process_started") and
(
 process.parent.name:("ssm-session-worker.exe" or "ssm-session-worker" or "ssm-document-worker.exe" or "ssm-document-worker") or 
 (process.name : "powershell.exe" and process.args : *awsrunPowerShellScript*) or
 (process.name : ("dash" or "sh" or "bash") and process.args : *awsrunShellScript*) or 
 (process.parent.name : "powershell.exe" and process.parent.args : *awsrunPowerShellScript*) or
 (process.parent.name : ("dash" or "sh" or "bash") and process.parent.args : *awsrunShellScript*)
 ) and 
 not (process.name : "powershell.exe" and process.args :("$str.Substring($str.length" or *Convert-GuidToCompressedGuid* or get-wmiobject* or $wmi_proc* or *win32_quickfixengineering* or Get-wmiobject* or *Get-Service* or *Get-WmiObject* or *System32\\ntoskrnl.exe* or *GET-WMIOBJECT*)) and 
 not process.executable : ("/usr/bin/lscpu" or "/usr/bin/snap" or "/usr/bin/rpm" or "/usr/bin/dpkg-query" or /snap/snapd/*/usr/bin/snap or "/usr/bin/id" or "C:\\Program Files\\Amazon\\SSM\\Plugins\\SessionManagerShell\\winpty-agent.exe" or /var/lib/amazon/ssm/update/amazon-ssm-agent-updater/*/updater or C\:\\ProgramData\\Amazon\\SSM\\Update\\amazon-ssm-agent-updater\\*\\updater.exe) and 
 not (process.name : (dash or bash or sh or _script.sh) and process.args : /var/lib/amazon/ssm/*/document/orchestration/*/_script.sh) and 
 process.command_line :(* and not (*ssm-user or */invokeInspectorSsmPluginLinux/_script.sh or */checkExclusionPreference/_script.sh or *\\createUpdateFolder\\_script.ps1 or */checkProvisioningEligibility/_script.sh or */install/_script.sh or */uninstall/_script.sh))

False Positives

• ⚠ Legitimate operators using AWS Systems Manager Session Manager to administer instances will spawn child processes under the session worker. Tune with host, user, or command-line exclusions for known automation and break-glass workflows.
• ⚠ The SSM agent may invoke short-lived utilities (for example identity or environment probes) during session setup. Additional exclusions may be required in your environment.