Command and Scripting Interpreter: Cloud API T1059.009

Tactic: Execution

Adversaries may abuse cloud APIs to execute malicious commands. APIs available in cloud environments provide various functionalities and are a feature-rich method for programmatic access to nearly all aspects of a tenant. These APIs may be utilized through various methods such as command line interpreters (CLIs), in-browser Cloud Shells, PowerShell modules like Azure for PowerShell, or software developer kits (SDKs) available for languages such as Python.

Events covered

1 catalog event is tagged with this technique by at least one rule.

ProviderEventTitle
MSSQLSERVEREvent ID 8128Event ID 8128

Authoring guide

Patterns shared across the 6 rules above: which fields they filter on, what specific values they look for, and what they exclude. The catalog normalizes field names across vendors so Sigma's Image, Elastic's process.name, and Splunk's process_name collapse into one row. Each rule contributes at most once per row.

Fields filtered most (13 distinct)

The fields most rules look at when detecting this technique. The How column shows the operators authors use (eq, wildcard, regex_match, match) and how often each appears. Sample values are concrete examples to start from, not an exhaustive list.

FieldRulesHowSample values
aws::eventName3eq 3CreateAccessKey, CreateLoginProfile, CreateUser, GetLoginProfile, PutUserPolicy
aws::eventSource3eq 3iam.amazonaws.com
userAgent3contains 3s3 browser
EventType2eq 2, in 1CreateEnvironment, ModifyInstanceAttribute, StartInstances, StopInstances
Provider_Name2eq 2cloudshell.amazonaws.com, ec2.amazonaws.com
aws::requestParameters2contains 2, starts_with 1allow, arn:aws:s3:::<your-bucket-name>/, s3:getobject, userdata=
event.outcome2eq 2success
Channel1eq 1, in 1
Esql.event_action_unique_count1eq 13
EventID1eq 18128
aws::userIdentity.type1ne 1AWSService
data_stream.dataset1eq 1aws.cloudtrail
eventtype1eq 1

Top indicator values (22 distinct)

Specific (field, operator, value) combinations the rules check for, ranked by how many rules under this technique use each one. The Corpus reach column counts how many rules across the entire catalog (any technique) check the same combination. High numbers point to widely-used indicators that are likely noisy on their own; combine them with another condition for useful signal. Blank means the combination is specific to rules under this technique. Click a value to expand the rules under this technique that use it.

FieldKindValueRules (here)Corpus reach
aws::eventSourceeq
iam.amazonaws.com
328
userAgentcontains
s3 browser
33
event.outcomeeq
success
2251
Esql.event_action_unique_counteq
3
1
EventIDeq
8128
1
EventTypeeq
CreateEnvironment
1
EventTypeeq
ModifyInstanceAttribute
12
EventTypein
StartInstances
1
EventTypein
StopInstances
1
Provider_Nameeq
cloudshell.amazonaws.com
1
Provider_Nameeq
ec2.amazonaws.com
119
aws::eventNameeq
CreateAccessKey
19
aws::eventNameeq
CreateLoginProfile
13
aws::eventNameeq
CreateUser
14
aws::eventNameeq
GetLoginProfile
1
aws::eventNameeq
PutUserPolicy
12
aws::requestParameterscontains
allow
1
aws::requestParameterscontains
s3:getobject
1
aws::requestParameterscontains
userdata=
1
aws::requestParametersstarts_with
arn:aws:s3:::<your-bucket-name>/
1
aws::userIdentity.typene
AWSService
15
data_stream.dataseteq
aws.cloudtrail
1141

Exclusions (5 distinct)

Field/operator/value combinations excluded by rules under this technique (top-level not() clauses), sorted by how many rules exclude each. These are the false-positive paths the community has learned to filter out. A new rule that ignores the high-count entries here will likely fire on the same noisy paths. Click a value to expand the rules under this technique that exclude it.

FieldKindValueRules excluding
aws::sourceIPAddressin
cloudformation.amazonaws.com
1
aws::sourceIPAddressin
servicecatalog.amazonaws.com
1
aws::userAgentcontains
ansible
1
aws::userAgentcontains
pulumi
1
aws::userAgentcontains
terraform
1

Rules under this technique

Every rule in the catalog tagged with this technique, grouped by vendor. Click a rule title for its full predicates, exclusions, and indicators.

Platform (all)
Domain (all)

Sigma 3 rules

Elastic 2 rules

Splunk 1 rule