detection.wiki

AWS CloudShell

eventNameDescriptionSampleRule
anyCatch-all entry for AWS CloudShell rules that match the service but not a specific eventName.NN
CreateEnvironmentCreates a new AWS CloudShell environment, provisioning a pre-authenticated browser-based shell session with AWS CLI access.NY

any: AWS CloudShell (catch-all)

#
Service
cloudshell

Description

Catch-all entry for AWS CloudShell rules that match the service but not a specific eventName.

CreateEnvironment

#
Service
cloudshell

Description

Creates a new AWS CloudShell environment, provisioning a pre-authenticated browser-based shell session with AWS CLI access.

Detection Fields #

Fields referenced by at least one attached detection rule. This view counts distinct rules and is not a complete event schema.

NameRulesVendors
event.action1 detection ruleElastic
event.outcome1 detection ruleElastic
event.provider1 detection ruleElastic

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Elastic #

  • AWS CloudShell Environment Created source high: Identifies the creation of a new AWS CloudShell environment. CloudShell is a browser-based shell that provides command-line access to AWS resources directly from the AWS Management Console. The CreateEnvironment API is called when a user launches CloudShell for the first time or when accessing CloudShell in a new AWS region. Adversaries with console access may use CloudShell to execute commands, install tools, or interact with AWS services without needing local CLI credentials. Monitoring environment creation helps detect unauthorized CloudShell usage from compromised console sessions.T1059, T1059.009, T1078, T1078.004