AWS Systems Manager Session Manager Session Started

Lucas Pinho@lucaslapinho

•updated Aug 17, 2026•0•0•3

Detects the initiation of an AWS Systems Manager (SSM) Session Manager session. The 'StartSession' API call is used to establish interactive remote shell sessions to managed instances (such as EC2). Monitoring this activity is critical for identifying potential remote administrative access, which could be abused for unauthorized management of cloud resources.