ATT&CK technique
View on MITRE ATT&CK →
T1059.009
Cloud API
Execution
7 detections found
Detection rules
| Source | Rule | Status | Updated |
|---|---|---|---|
| elastic | AWS CloudShell Environment Created | production | 2026-09-18 |
| elastic | AzCopy or Azure Storage Explorer Usage on Unusual Host | production | 2026-09-18 |
| elastic | AWS EC2 Stop, Start, and User Data Modification Correlation | production | 2026-09-18 |
| splunk | Windows SQL Server Extended Procedure DLL Loading Hunt | production | 2026-05-13 |
| sigma | AWS IAM S3Browser LoginProfile Creation | test | 2023-05-17 |
| sigma | AWS IAM S3Browser User or AccessKey Creation | test | 2023-05-17 |
| sigma | AWS IAM S3Browser Templated S3 Bucket Policy Creation | test | 2023-05-17 |