kqlElastic-2.0from elastic/detection-rules

AWS CLI Command with Custom Endpoint URL

Quality

FP risk

—

Forks

Views

ATT&CK techniques

T1102 T1102.002

Rule sourcerules/linux/command_and_control_aws_cli_endpoint_url_used.toml

host.os.type:"linux" and event.category:"process" and
event.action:("exec" or "exec_event" or "executed" or "process_started" or "ProcessRollup2") and
process.name:"aws" and process.args:"--endpoint-url"