Elastic Security Detection Rules

AWS CLI with Kali Linux Fingerprint Identified

Last updated a month ago on 2025-04-16
Created a month ago on 2025-04-11

About

Identifies the usage of the AWS CLI with a user agent string containing `distrib#kali`, which suggests the request was made from a Kali Linux distribution. This may indicate offensive security tooling or unauthorized use of the AWS CLI from a potentially adversarial environment.
Tags
Domain: CloudData Source: AWSData Source: Amazon Web ServicesData Source: AWS CloudTrailTactic: Initial AccessUse Case: Cloud Threat DetectionLanguage: kuery
Severity
medium
Risk Score
47
MITRE ATT&CK™

Initial Access (TA0001)(opens in a new tab or window)

↳ Valid Accounts (T1078)(opens in a new tab or window)

False Positive Examples
While rare, legitimate users or red teamers may use Kali Linux for security assessments. Confirm the identity of the user, their purpose, and whether the activity was authorized.
License
Elastic License v2(opens in a new tab or window)

Definition

Rule Type
Query (Kibana Query Language)
Integration Pack
Prebuilt Security Detection Rules
Index Patterns
logs-aws.cloudtrail-*
Related Integrations

aws(opens in a new tab or window)

Query
event.dataset: "aws.cloudtrail" and user_agent.original: (aws-cli*distrib#kali* or Boto3*distrib#kali*)

Install detection rules in Elastic Security

Detect AWS CLI with Kali Linux Fingerprint Identified in the Elastic Security detection engine by installing this rule into your Elastic Stack.

To setup this rule, check out the installation guide for Prebuilt Security Detection Rules(opens in a new tab or window).