Multi-Cloud CLI Token and Credential Access Commands

FROM logs-endpoint.events.process-*, logs-system.security-*, logs-windows.sysmon_operational-* METADATA _id, _index, _version
| WHERE event.category == "process" 
AND KQL(""" event.type : "start" and not event.action : "fork" """)
  
AND process.command_line IS NOT NULL 
  
AND (
    TO_LOWER(process.name) IN (
      "cmd.exe", "powershell.exe", "pwsh.exe", 
      "sh", "bash", "zsh", "dash", "fish", "ksh",
      "gcloud", "gcloud.cmd", "az", "az.cmd", "azd", "azd.exe",
      "gh", "gh.exe", "aws", "aws.exe",
      "kubectl", "kubectl.exe",
      "doctl", "doctl.exe",
      "oci", "oci.exe"
    ) 
OR
    TO_LOWER(process.parent.name) IN (
      "cmd.exe", "powershell.exe", "pwsh.exe",
      "sh", "bash", "zsh", "dash", "fish", "ksh", "bun", "bun.exe", 
      "node", "node.exe", "java", "java.exe"
    )
  )
  
AND process.command_line RLIKE """.*(config-helper\s.*--format
| auth\s+print-access-token
| auth\s+print-identity-token
| auth\s+application-default\s+print
| get-access-token\s.*--output
| Get-AzAccessToken
| azd\s+auth\s+token
| az\s+account\s+get-access-token
| gh\s+auth\s+(token
| status)
| aws\s+sts\s+(get-session-token
| get-caller-identity
| assume-role)
| aws\s+configure\s+(export-credentials
| list)
| kubectl\s+config\s+view\s.*--raw
| kubectl\s+get\s+secret
| doctl\s+auth\s+(list
| init)
| oci\s+session\s+authenticate
| oci\s+iam\s.*token).*"""
| EVAL cloud_target = CASE(
    process.command_line RLIKE ".*(gcloud
| config-helper
| print-access-token
| print-identity-token).*", "GCP",
    process.command_line RLIKE ".*(azd auth
| az account
| Get-AzAccessToken).*", "AZURE",
    process.command_line RLIKE ".*(aws sts
| aws configure).*", "AWS",
    process.command_line RLIKE ".*(gh auth).*", "GITHUB",
    process.command_line RLIKE ".*(kubectl config
| kubectl get secret).*", "KUBERNETES",
    process.command_line RLIKE ".*(doctl).*", "DIGITALOCEAN",
    process.command_line RLIKE ".*(oci session
| oci iam).*", "ORACLE"
  )
| WHERE cloud_target IS NOT NULL // drop unclassified events before aggregation
| STATS
    Esql.cloud_targets = VALUES(cloud_target),
    Esql.unique_clouds = COUNT_DISTINCT(cloud_target),
    Esql.process_command_line_values = VALUES(process.command_line),
    Esql.process_parent_executable_values = VALUES(process.parent.executable),
    Esql.first_seen = MIN(@timestamp),
    Esql.last_seen = MAX(@timestamp),
    Esql.event_count = COUNT(*)
  BY host.name, host.id, user.name
| WHERE Esql.unique_clouds >= 2
| KEEP Esql.*, user.name, host.name, host.id

False Positives

• ⚠ Automation, CI runners, and platform engineering scripts may legitimately print tokens or dump kubeconfig across providers in one session. Baseline approved identities and runner images before tuning thresholds.