T1059.009 — Cloud API

T1059.009 Command and Scripting Interpreter: Cloud API

title: "T1059.009 Command and Scripting Interpreter: Cloud API"
id: d2f4f90e-7744-4fb8-a459-b042bf6e3c3d
description: 'Behavioral Detection of Malicious Cloud API Scripting, scoped to high-risk IAM/credential, storage-policy, and compute-provisioning subcommands (e.g. aws iam create-access-key, aws s3api put-bucket-policy, aws ec2 run-instances; az role assignment/storage account changes; gcloud iam service-account key creation, project IAM policy binding, compute instance creation) rather than any invocation of the aws/az/gcloud CLI. (Data Component: Command Execution; baseline tier: fallback.) Tune using: TimeWindow, UserAgent, CredentialType, APISequence, ConsoleContext.'
references:
  - https://attack.mitre.org/techniques/T1059/009
author: Shahrukh Khan
date: 2026-02-08
license: MIT
tags:
  - attack.execution
  - attack.t1059.009

logsource:
  category: process_creation
  product: linux
  service: auditd

detection:
  selection_aws_base:
    type: EXECVE
    a0|endswith: '/aws'
  selection_aws_hr_iam:
    a1|contains:
      - 'iam'
      - 'sts'
    a2|contains:
      - 'create-access-key'
      - 'create-login-profile'
      - 'attach-user-policy'
      - 'attach-role-policy'
      - 'put-user-policy'
      - 'put-role-policy'
      - 'create-role'
      - 'assume-role'
  selection_aws_hr_s3:
    a1: 's3api'
    a2|contains:
      - 'put-bucket-policy'
      - 'put-bucket-acl'
      - 'put-public-access-block'
  selection_aws_hr_ec2:
    a1: 'ec2'
    a2|contains:
      - 'run-instances'
      - 'create-security-group'
      - 'authorize-security-group-ingress'
  selection_az_base:
    type: EXECVE
    a0|endswith: '/az'
  selection_az_hr_role:
    a1|contains:
      - 'role'
      - 'ad'
    a2|contains:
      - 'assignment'
      - 'sp'
  selection_az_hr_storage:
    a1: 'storage'
    a2: 'account'
    a3|contains:
      - 'update'
      - 'create'
  selection_gcloud_base:
    type: EXECVE
    a0|endswith: '/gcloud'
  selection_gcloud_hr_iam:
    a1: 'iam'
    a2: 'service-accounts'
    a3: 'keys'
  selection_gcloud_hr_project:
    a1: 'projects'
    a2|contains: 'add-iam-policy-binding'
  selection_gcloud_hr_compute:
    a1: 'compute'
    a2: 'instances'
    a3|contains: 'create'

  condition: (selection_aws_base and 1 of selection_aws_hr_*) or (selection_az_base and 1 of selection_az_hr_*) or (selection_gcloud_base and 1 of selection_gcloud_hr_*)

falsepositives:
  - Routine but privileged cloud administration and CI/CD/infrastructure-as-code pipelines that legitimately create IAM keys/roles, adjust bucket/security-group policies, or provision compute; scope with CredentialType/UserAgent to distinguish human interactive sessions from known automation service accounts, and use APISequence/TimeWindow to catch bursts of these actions rather than isolated expected changes.

level: high