Investigation: Azure and AWS CLI Cloud Environment Recon from Windows Endpoint

1. Confirm the alert

   Detects the az or aws command-line tools enumerating cloud identities, roles and resources from a Windows endpoint (az account/ad user/role assignment list, aws sts get-caller-identity, aws iam list-users/roles). Post-compromise Cloud Service Discovery (ATT&CK T1526) via a stolen workstation's CLI session is an early step toward cloud pivot and privilege escalation. The rule matched on logsource `process_creation`. Verify the event genuinely matches the described behavior, and not a known legitimate case. The rule matches on these fields — examine the exact value in the event:

   • **CommandLine** contains: `account list`, `ad user list`, `ad group list`, `role assignment list` …
   • **Image** contains: `\az.cmd`, `\az.exe`, `\aws.exe`

2. Pivot: find the origin and context

   Investigation queries (read-only):

   • Parent of the triggering process (full execution chain)
   • Other processes spawned by the same parent within 10 minutes
   • Is the binary signed? unusual path (%TEMP%, %APPDATA%, user directory)?

3. Rule out false positives

   Known benign causes for this rule:

   • DevOps engineers inventorying cloud resources from a managed admin workstation; scope by user or host.

4. Context (threat intelligence)

   The rule's references — CTI context to qualify the incident:

   • https://attack.mitre.org/techniques/T1526/