Cloud CLI Bulk Storage Deletion via aws s3 rm, az delete-batch, or gsutil rm

Ankit Mehta@Secvyn

•updated Jun 27, 2026•0•0•1

Detects the execution of cloud CLI tools (aws, az, gsutil) using commands designed for bulk or recursive deletion of data from cloud object storage (S3, Azure Blob, GCS). This activity is commonly associated with destructive attacks, ransomware, or unauthorized data removal.