Execution of malicious dlp.sh/dlp-docker.sh via Terraform external data source

Arnold Chan@slaz

•updated Sep 7, 2026•0•0•0

This rule detects the execution of specific DLP-related shell scripts (dlp.sh, dlp-docker.sh) being invoked by Terraform processes. This pattern may indicate suspicious automated infrastructure configuration or an attempt to bypass security controls by leveraging IaC tools to execute scripts.