Potential Destructive AWS CLI Command Executed by GenAI Agent

  1[metadata]
  2creation_date = "2026/09/14"
  3integration = ["endpoint"]
  4maturity = "production"
  5updated_date = "2026/09/14"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Identifies a cloud CLI command that destroys infrastructure or identities, such as terminating EC2 instances, removing
 11S3 buckets, or deleting IAM users, when it is spawned by a GenAI coding agent directly or through the agent's shell
 12wrapper. A compromised or prompt-injected agent can be steered into wiping the developer's environment and cloud
 13account using the credentials it already holds, as seen in the malicious Amazon Q Developer for VS Code v1.84.0
 14release (AWS-2025-015).
 15"""
 16false_positives = [
 17    """
 18    Authorized infrastructure teardown automation may legitimately invoke these commands. Correlate with change
 19    management records and known deployment pipeline identities before escalating.
 20    """,
 21    """
 22    Developers who explicitly instruct an agent to tear down a development environment or rotate access keys will
 23    trigger this rule. Confirm intent with the user before escalating.
 24    """,
 25]
 26from = "now-9m"
 27index = ["logs-endpoint.events.process*"]
 28language = "kuery"
 29license = "Elastic License v2"
 30name = "Potential Destructive AWS CLI Command Executed by GenAI Agent"
 31references = [
 32    "https://aws.amazon.com/security/security-bulletins/AWS-2025-015/",
 33    "https://github.com/aws/aws-toolkit-vscode/security/advisories/GHSA-7g7f-ff96-5gcw",
 34    "https://www.theregister.com/2025/07/24/amazon_q_ai_prompt/",
 35    "https://www.pointguardai.com/blog/clean-to-factory-state-the-ai-prompt-that-nearly-wiped-aws-accounts",
 36]
 37note = """## Triage and analysis
 38
 39### Investigating Potential Destructive AWS CLI Command Executed by GenAI Agent
 40
 41This rule detects a GenAI coding agent spawning a cloud CLI command that destroys infrastructure or identities. A compromised or prompt-injected agent can be steered into wiping the developer's AWS account without any separate credential theft step, since the agent already holds the developer's credentials. The malicious Amazon Q Developer pull request in July 2025 (AWS-2025-015) is the canonical real-world example of this attack pattern.
 42
 43### Possible investigation steps
 44
 45- Identify the GenAI agent parent process and determine whether it was running in an autonomous or interactive mode at the time of the alert.
 46- Review the full CLI command arguments to assess the scope of the destruction (resource IDs, `--recursive` flags, etc.).
 47- Check for a preceding unusual or injected prompt in the agent's context, such as content from a recently cloned repository, an opened file, or a web fetch result.
 48- Query AWS CloudTrail for the corresponding API call and confirm whether the destructive action was actually executed or was blocked.
 49- Determine if the user initiated the teardown intentionally or if it was triggered autonomously.
 50
 51### False positive analysis
 52
 53- Authorized infrastructure teardown automation invoked through a GenAI interface may legitimately trigger this rule. Correlate with change management records and known deployment pipeline identities before escalating.
 54- Developers who explicitly instruct a GenAI agent to clean up development environments will generate alerts for legitimate use.
 55
 56### Response and remediation
 57
 58- Initiate the incident response process based on the outcome of the triage.
 59- If the destructive command executed, immediately assess which resources were deleted and begin recovery from backups or infrastructure-as-code.
 60- Revoke the developer's AWS credentials and rotate them after confirming the scope of the compromise.
 61- Review the agent's recent conversation history and any external content it processed to identify the prompt injection source.
 62- Apply IAM permission boundaries on developer credentials to restrict the blast radius of future incidents.
 63"""
 64risk_score = 73
 65rule_id = "2635d2ba-51e7-404a-9b17-db413a1351d5"
 66setup = """## Setup
 67
 68This rule requires data coming in from Elastic Defend.
 69
 70### Elastic Defend Integration Setup
 71Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the
 72Elastic Agent to monitor events on your host and send data to the Elastic Security app.
 73
 74#### Prerequisite Requirements:
 75- Fleet is required for Elastic Defend.
 76- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html).
 77
 78#### The following steps should be executed in order to add the Elastic Defend integration:
 79- Go to the Kibana home page and click "Add integrations".
 80- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
 81- Click "Add Elastic Defend".
 82- Configure the integration name and optionally add a description.
 83- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
 84- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can
 85  click the "Existing hosts" tab and select an existing policy instead.
 86- Click "Save and Continue".
 87- To complete the integration, select "Add Elastic Agent to your hosts" and install Elastic Agent on your hosts.
 88For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html).
 89"""
 90severity = "high"
 91tags = [
 92    "Domain: Endpoint",
 93    "Domain: Cloud",
 94    "Domain: GenAI",
 95    "Platform: AWS",
 96    "Platform: Linux",
 97    "Platform: macOS",
 98    "Platform: Windows",
 99    "Platform: Kubernetes",
100    "OS: Linux",
101    "OS: macOS",
102    "OS: Windows",
103    "Service: AWS EC2",
104    "Service: AWS S3",
105    "Service: AWS IAM",
106    "Service: AWS RDS",
107    "Service: AWS Lambda",
108    "Tactic: Impact",
109    "Tactic: Defense Evasion",
110    "Data Source: Elastic Defend",
111    "Rule Type: Custom Query (KQL)",
112    "Resources: Investigation Guide",
113    "Mitre Atlas: T0051",
114]
115timestamp_override = "event.ingested"
116type = "query"
117
118query = '''
119event.category : "process" and event.type : "start" and event.action : (start or exec) and
120(
121  process.parent.name : (
122    qterm or qterm.exe or qchat or qchat.exe or
123    kiro or "kiro-cli" or "kiro-cli-chat" or "kiro-cli-term" or
124    kiro.exe or "kiro-cli.exe" or "kiro-cli-chat.exe" or "kiro-cli-term.exe" or
125    claude or "claude-bin" or claude.exe or codex or codex.exe or
126    copilot or copilot.exe or cursor or cursor.exe or "Cursor Helper (Plugin)" or "Cursor Helper" or
127    "gemini-cli" or "gemini-cli.exe" or windsurf or windsurf.exe or
128    aider or aider.exe or cline or goose or goose.exe or opencode or opencode.exe
129  ) or
130  process.parent.executable : (
131    */.local/bin/q or */usr/local/bin/q or
132    *\\Users\\*\\AppData\\Local\\Programs\\Amazon Q\\q.exe or
133    *\\Users\\*\\AppData\\Local\\Programs\\Amazon Q\\*\\q.exe or
134    *\\Program Files\\Amazon Q\\q.exe or
135    *\\Program Files\\Amazon Q\\*\\q.exe
136  ) or
137  (
138    process.parent.name : (bash or zsh or sh or dash or cmd.exe or powershell.exe or pwsh or pwsh.exe) and
139    process.parent.command_line : (
140      */.claude/shell-snapshots/* or *\\.claude\\shell-snapshots\\* or
141      */.codex/* or *\\.codex\\* or
142      */.kiro/* or *\\.kiro\\* or
143      */.aws/amazonq/* or *\\.aws\\amazonq\\* or
144      */.goose/* or */.opencode/* or */.aider*
145    )
146  )
147) and
148(
149  (
150    process.name : (aws or aws.exe) and
151    process.command_line : (
152      *ec2 terminate-instances* or *ec2 delete-volume* or *ec2 delete-snapshot* or
153      *s3 rb* or *s3 rm*--recursive* or *s3api delete-bucket* or *s3api delete-objects* or
154      *iam delete-user* or *iam delete-role* or *iam delete-login-profile* or *iam delete-access-key* or
155      *rds delete-db-instance* or *rds delete-db-cluster* or *dynamodb delete-table* or
156      *efs delete-file-system* or *eks delete-cluster* or *ecs delete-cluster* or
157      *lambda delete-function* or *kms schedule-key-deletion* or
158      *cloudformation delete-stack* or
159      *cloudtrail delete-trail* or *cloudtrail stop-logging* or
160      *backup delete-recovery-point* or *organizations close-account*
161    )
162  ) or
163  (
164    process.name : (sam or sam.exe) and process.command_line : *sam delete*
165  ) or
166  (
167    process.name : (terraform or terraform.exe or tofu or tofu.exe) and
168    process.command_line : *destroy*-auto-approve*
169  ) or
170  (
171    process.name : (kubectl or kubectl.exe) and
172    process.command_line : (*delete*--all* or *delete namespace* or *delete ns*)
173  )
174) and not process.args : ("--dry-run*" or "--help*" or "-help*" or "-h" or "help" or "--version*")
175'''
176
177[[rule.threat]]
178framework = "MITRE ATT&CK"
179
180[[rule.threat.technique]]
181id = "T1485"
182name = "Data Destruction"
183reference = "https://attack.mitre.org/techniques/T1485/"
184
185[[rule.threat.technique]]
186id = "T1531"
187name = "Account Access Removal"
188reference = "https://attack.mitre.org/techniques/T1531/"
189
190[rule.threat.tactic]
191id = "TA0040"
192name = "Impact"
193reference = "https://attack.mitre.org/tactics/TA0040/"
194
195[[rule.threat]]
196framework = "MITRE ATT&CK"
197
198[[rule.threat.technique]]
199id = "T1562"
200name = "Impair Defenses"
201reference = "https://attack.mitre.org/techniques/T1562/"
202
203[[rule.threat.technique.subtechnique]]
204id = "T1562.008"
205name = "Disable or Modify Cloud Logs"
206reference = "https://attack.mitre.org/techniques/T1562/008/"
207
208[rule.threat.tactic]
209id = "TA0005"
210name = "Defense Evasion"
211reference = "https://attack.mitre.org/tactics/TA0005/"