2026 Critical Cloud Control Plane Detection: Cloud Shell Abuse: First-Use, Data Staging, Exfil Commands

Ibrahim Saud@tektrix

•updated 27 days ago•2•0•4

This rule detects anomalous activity involving cloud-based shell services (AWS CloudShell, Azure Cloud Shell, GCP Cloud Shell). It triggers on two main conditions: (1) First-time usage of these shell environments by a principal within the detection window, and (2) The execution of commands associated with data staging, ingress tool transfer, or exfiltration (e.g., curl, wget, storage copy commands).