AWS CloudShell

eventName	Description	Sample	Rule
CreateEnvironment	Creates a new AWS CloudShell environment, provisioning a pre-authenticated browser-based shell session with AWS CLI access.	N	Y

CreateEnvironment

Service: cloudshell

Description

Creates a new AWS CloudShell environment, provisioning a pre-authenticated browser-based shell session with AWS CLI access.

Detection Fields #

Fields referenced by at least one attached detection rule. This view counts distinct rules and is not a complete schema for this catalog entry.

Name	Rules	Vendors
`event.action`	1 detection rule	Elastic
`event.outcome`	1 detection rule	Elastic
`event.provider`	1 detection rule	Elastic

Detection Rules #

Full rule details for this catalog entry, including ATT&CK technique mappings and native queries →

Elastic #

AWS CloudShell Environment Created source high: Identifies the creation of a new AWS CloudShell environment. CloudShell is a browser-based shell that provides command-line access to AWS resources directly from the AWS Management Console. The CreateEnvironment API is called when a user launches CloudShell for the first time or when accessing CloudShell in a new AWS region. Adversaries with console access may use CloudShell to execute commands, install tools, or interact with AWS services without needing local CLI credentials. Monitoring environment creation helps detect unauthorized CloudShell usage from compromised console sessions.T1059, T1059.009, T1078, T1078.004

any: AWS CloudShell (catch-all)

Scope grouping: This repository-authored catalog entry represents a broad attribution scope, not a distinct emitted event or operation. Any sample below is a representative record from that scope; attached rules, if any, are listed separately.

Service: cloudshell

Description

Catch-all entry for AWS CloudShell rules that match the service but not a specific eventName.