DEF CON 34 – Jenko Hwong, Chris Ryan – Azure CloudShell abused for mining / exfil / persistence at scale

Ankit Mehta@Secvyn

•updated Aug 13, 2026•4•0•6

This rule detects a high frequency of sessions related to Azure Cloud Shell or portal consoles initiated from the same IP address within a one-hour window. Frequent access to Azure Cloud Shell can indicate potentially suspicious administrative behavior, reconnaissance, or automated interaction with the cloud environment.