Cloud CLI execution (tccli, aws, aliyun) from Cairn worker container context

ills3c Intel&Coffee@Ills3C

•updated 2 days ago•0•0•1

Detects the execution of cloud command-line tools (such as tccli, aws, aliyun) on devices that have previously run a Cairn worker container or dispatcher, helping to identify potential cloud reconnaissance or management activity from compromised or containerized hosts.