Cloud VM Discovery via az vm list, Get-AzVM, or aws ec2 describe-instances

Ankit Mehta@Secvyn

•updated Jun 26, 2026•0•0•3

This rule detects the use of common cloud command-line interfaces (Azure CLI, Azure PowerShell, and AWS CLI) to perform resource discovery, specifically identifying commands used to list virtual machines or describe EC2 instances. Such activity, if performed by an unexpected user or on an endpoint where cloud management tools are not typically installed, may indicate reconnaissance by an adversary.