AWS CloudShell

eventName	Description	Sample	Rule
any	Catch-all entry for AWS CloudShell rules that match the service but not a specific eventName.	N	N
CreateEnvironment	Creates a new AWS CloudShell environment, provisioning a pre-authenticated browser-based shell session with AWS CLI access.	N	Y

any: AWS CloudShell (catch-all)

Catch-all entry for AWS CloudShell rules that match the service but not a specific eventName.

Creates a new AWS CloudShell environment, provisioning a pre-authenticated browser-based shell session with AWS CLI access.

AWS CloudShell Environment Created source high: Identifies the creation of a new AWS CloudShell environment. CloudShell is a browser-based shell that provides command-line access to AWS resources directly from the AWS Management Console. The CreateEnvironment API is called when a user launches CloudShell for the first time or when accessing CloudShell in a new AWS region. Adversaries with console access may use CloudShell to execute commands, install tools, or interact with AWS services without needing local CLI credentials. Monitoring environment creation helps detect unauthorized CloudShell usage from compromised console sessions.T1059, T1059.009, T1078, T1078.004