Cloud Credential Pivot from Compromised Developer Workstation within 60 Minutes

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•5

This rule detects potential developer workstation compromise by monitoring for suspicious child process creation (shells/interpreters) from common development tools (Code.exe, node.exe, python.exe) followed by subsequent authentication to cloud environments (Azure, AWS, or GCP) within a 60-minute window. This behavior is indicative of a developer's machine being compromised to harvest session tokens or credentials to access cloud resources.