BeepRAT/MCP AWS Credential Enumeration via aws CLI from Developer Process

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•5

Detects the execution of AWS CLI commands typically used for cloud resource enumeration (e.g., listing users, roles, buckets, or identity information) when spawned by common development environments, IDEs, or shell interpreters. This rule is designed to identify potential post-exploitation activity where an attacker uses compromised developer credentials or environments to map the cloud infrastructure.