2026 Critical Cloud Control Plane Detection: Cloud Shell Used to Download and Execute External Offensive Tooling
Detects the use of AWS CloudShell to execute commands that download or install external files (e.g., using curl, wget, pip, or git), excluding those originating from known approved sources such as AWS-owned domains or standard package registries. This behavior may indicate an adversary attempting to download offensive tooling or backdoors into the cloud environment.
Sigma
