Elastic high stable kql

AWS CloudShell Environment Created

Identifies the creation of a new AWS CloudShell environment. CloudShell is a browser-based shell that provides command-line access to AWS resources directly from the AWS Management Console. The CreateEnvironment API is called when a user launches CloudShell for the first time or when accessing CloudShell in a new AWS region. Adversaries with console access may use CloudShell to execute commands, install tools, or interact with AWS services without needing local CLI credentials. Monitoring environment creation helps detect unauthorized CloudShell usage from compromised console sessions.

View Source

Detection Logic

data_stream.dataset: "aws.cloudtrail"
    and event.provider: "cloudshell.amazonaws.com"
    and event.action: "CreateEnvironment"
    and event.outcome: "success"

False Positives

⚠ Legitimate use of CloudShell by administrators for routine AWS management tasks. Verify whether the user has a legitimate need for CloudShell access and correlate with recent console login activity. Environment creation also occurs when users access CloudShell in a new AWS region.

Field Validations

Loading…

Comments (0)

Loading comments...