AWS CloudShell Environment Created

  1[metadata]
  2creation_date = "2026/03/12"
  3integration = ["aws"]
  4maturity = "production"
  5updated_date = "2026/03/12"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Identifies the creation of a new AWS CloudShell environment. CloudShell is a browser-based shell that provides
 11command-line access to AWS resources directly from the AWS Management Console. The CreateEnvironment API is called when
 12a user launches CloudShell for the first time or when accessing CloudShell in a new AWS region. Adversaries with console
 13access may use CloudShell to execute commands, install tools, or interact with AWS services without needing local CLI
 14credentials. Monitoring environment creation helps detect unauthorized CloudShell usage from compromised console
 15sessions.
 16"""
 17false_positives = [
 18    """
 19    Legitimate use of CloudShell by administrators for routine AWS management tasks. Verify whether the user has a
 20    legitimate need for CloudShell access and correlate with recent console login activity. Environment creation also
 21    occurs when users access CloudShell in a new AWS region.
 22    """,
 23]
 24from = "now-6m"
 25index = ["filebeat-*", "logs-aws.cloudtrail-*"]
 26language = "kuery"
 27license = "Elastic License v2"
 28name = "AWS CloudShell Environment Created"
 29note = """## Triage and analysis
 30
 31### Investigating AWS CloudShell Environment Created
 32
 33AWS CloudShell is a browser-based shell environment that provides instant command-line access to AWS resources without requiring local CLI installation or credential configuration. While this is convenient for legitimate administrators, it also provides adversaries with a powerful tool if they gain access to a compromised AWS console session.
 34
 35This rule detects when a CloudShell environment is created via the `CreateEnvironment` API. This event occurs when a user launches CloudShell for the first time or when accessing CloudShell in a new AWS region (each region maintains a separate environment). 
 36
 37### Possible investigation steps
 38
 39- **Identify the actor**
 40  - Review `aws.cloudtrail.user_identity.arn` or `user.name` to determine which IAM principal created the CloudShell environment.
 41  - Check `aws.cloudtrail.user_identity.type` to identify whether this is an IAM user or an assumed role session.
 42  - Verify if this user typically performs command-line or administrative operations.
 43
 44- **Analyze the source context**
 45  - Review `source.ip` and `source.geo` fields to verify the request origin matches expected administrator locations.
 46  - Check `user_agent.original` to confirm the request came from a browser session.
 47  - Look for the preceding `ConsoleLogin` event to understand how the session was established.
 48
 49- **Correlate with surrounding activity**
 50  - Look for any IAM operations (CreateAccessKey, CreateUser, AttachRolePolicy) that occurred after CloudShell was accessed.
 51  - Check for data exfiltration patterns or reconnaissance activity from the same session.
 52
 53- **Assess the broader context**
 54  - Determine if this user has a legitimate need for CloudShell access based on their role.
 55  - Review recent access patterns for the console session that initiated CloudShell.
 56  - Check if MFA was used for the console login.
 57
 58### False positive analysis
 59
 60- Administrators routinely using CloudShell for AWS management tasks will trigger this rule. Consider tuning for known admin users if noise is a concern.
 61- Users accessing CloudShell in a new AWS region will generate a `CreateEnvironment` event even if they have used CloudShell before in other regions.
 62- Training or certification activities may involve CloudShell environment creation.
 63
 64### Response and remediation
 65
 66- If unauthorized, immediately terminate the console session to revoke CloudShell access.
 67- Review and revoke any credentials or resources created during the CloudShell session.
 68- Consider restricting CloudShell access via SCPs or IAM policies for sensitive accounts or users who do not require it.
 69- Implement session duration limits to reduce the window of opportunity for console session abuse.
 70- Enable MFA for all console logins to reduce the risk of session compromise.
 71
 72### Additional information
 73
 74- **[AWS IR Playbooks](https://github.com/aws-samples/aws-incident-response-playbooks/)**
 75- **[AWS Customer Playbook Framework](https://github.com/aws-samples/aws-customer-playbook-framework/tree/a8c7b313636b406a375952ac00b2d68e89a991f2/docs)** 
 76"""
 77references = [
 78    "https://aws-samples.github.io/threat-technique-catalog-for-aws/Techniques/T1059.009.html",
 79    "https://permiso.io/blog/lucr-3-scattered-spider-getting-saas-y-in-the-cloud",
 80]
 81risk_score = 21
 82rule_id = "b625c9ad-16e5-4f16-8d38-3e9631952554"
 83severity = "low"
 84tags = [
 85    "Domain: Cloud",
 86    "Data Source: AWS",
 87    "Data Source: Amazon Web Services",
 88    "Data Source: AWS CloudTrail",
 89    "Data Source: AWS CloudShell",
 90    "Use Case: Threat Detection",
 91    "Tactic: Execution",
 92    "Resources: Investigation Guide",
 93]
 94timestamp_override = "event.ingested"
 95type = "query"
 96
 97query = '''
 98event.dataset: "aws.cloudtrail"
 99    and event.provider: "cloudshell.amazonaws.com"
100    and event.action: "CreateEnvironment"
101    and event.outcome: "success"
102'''
103
104
105[[rule.threat]]
106framework = "MITRE ATT&CK"
107[[rule.threat.technique]]
108id = "T1059"
109name = "Command and Scripting Interpreter"
110reference = "https://attack.mitre.org/techniques/T1059/"
111[[rule.threat.technique.subtechnique]]
112id = "T1059.009"
113name = "Cloud API"
114reference = "https://attack.mitre.org/techniques/T1059/009/"
115
116
117
118[rule.threat.tactic]
119id = "TA0002"
120name = "Execution"
121reference = "https://attack.mitre.org/tactics/TA0002/"
122
123[rule.investigation_fields]
124field_names = [
125    "@timestamp",
126    "user.name",
127    "user_agent.original",
128    "source.ip",
129    "aws.cloudtrail.user_identity.arn",
130    "aws.cloudtrail.user_identity.type",
131    "aws.cloudtrail.user_identity.access_key_id",
132    "event.action",
133    "event.outcome",
134    "cloud.account.id",
135    "cloud.region",
136    "aws.cloudtrail.request_parameters",
137    "aws.cloudtrail.response_elements",
138]