AWS Credential Exfiltration via Amazon Q MCP Spawned Process (CVE-2026-12957)

Ibrahim Saud@tektrix

•updated Jun 26, 2026•0•0•2

This rule detects suspicious activities involving AWS CLI or curl commands spawned from IDE-related processes (amazonq-language-server, Code.exe). It monitors for command patterns indicating credential discovery (aws sts get-caller-identity) or data exfiltration (curl POST requests), and correlates these with unusual CloudTrail GetCallerIdentity events occurring from non-AWS source IP addresses.