-
Potential Destructive AWS CLI Command Executed by GenAI Agent
Sep 28, 2026 · Domain: Endpoint Domain: Cloud Domain: GenAI Platform: AWS Platform: Linux Platform: macOS Platform: Windows Platform: Kubernetes OS: Linux OS: macOS OS: Windows Service: AWS EC2 Service: AWS S3 Service: AWS IAM Service: AWS RDS Service: AWS Lambda Tactic: Impact Tactic: Defense Evasion Data Source: Elastic Defend Rule Type: Custom Query (KQL) Resources: Investigation Guide Mitre Atlas: T0051 ·Identifies a cloud CLI command that destroys infrastructure or identities, such as terminating EC2 instances, removing S3 buckets, or deleting IAM users, when it is spawned by a GenAI coding agent directly or through the agent's shell wrapper. A compromised or prompt-injected agent can be steered into wiping the developer's environment and cloud account using the credentials it already holds, as seen in the malicious Amazon Q Developer for VS Code v1.84.0 release (AWS-2025-015).
Read More