Detection catalogue

Explore published rules with transparent provenance, licensing, and ATT&CK mappings.

detections

Loading detections…

AWSCloudTrail - Suspicious AWS CLI Command Execution

This detection focuses on identifying potentially suspicious activities involving the execution of AWS Command Line Interface (CLI) commands, particularly focusing on reconnaissance operations.

ATT&CK coverage

Outside the enterprise matrix

T1589.002
T1589.003
T1590
T1591
T1592.004
T1595
T1596

Detection requirements

Log source product: aws
Log source service: awscloudtrail

What the source says

Tagged by the source as

Reconnaissance

Detection logic

Published to signed-in readers

The query as its source wrote it, its canonical form, and the content hash that pins this exact revision.