TeamPCP - Shell Recon Authentication Scraping (T1005)

Ibrahim Saud@tektrix

•updated Jun 21, 2026•4•0•8

This rule detects shell reconnaissance activities associated with the TeamPCP threat group. Specifically, it looks for commands that parse '/var/log/auth.log' for successful logins or execute 'env | grep AWS_' to find AWS credentials. This behavior is indicative of an attacker attempting to gather authentication information or cloud credentials from a compromised system.