This rule detects the first occurrence of an AWS Batch job submission that includes a container command override (containerOverrides.command). Such overrides allow runtime substitution of the job’s command, bypassing the original job definition review. A first-time submission by an identity (not observed in the prior 7 days) signals potential adversarial activity aiming to inject malicious commands or data exfiltration logic into otherwise legitimate Batch compute environments without modifying the underlying definition. The rule triggers on AWS CloudTrail logs (logs-aws.cloudtrail-*) for SubmitJob events from batch.amazonaws.com with a successful outcome and a request containing containerOverrides with a command override. It ties the event to MITRE ATT&CK Execution (T1059) and is designed to surface execution-time command changes that could indicate post-submission tampering or abuse of the compute environment. The rule provides investigation steps to verify the submitting principal, extract and analyze the overridden command, and correlate with job queues, definitions, and execution outputs. It also supports cross-reference with data access or exfiltration indicators during the job’s execution window (e.g., S3 GetObject/PutObject via the execution role). A false positive can occur for legitimate use cases where container overrides parameterize dynamic workloads or CI/CD pipelines. Possible investigation steps include identifying the submitting ARN, validating expected usage of Batch with overrides, extracting containerOverrides.command from request_parameters, inspecting environment variables and resources, locating the related job queue and job definition, and tracking execution status and outputs. If unauthorized, respond by terminating the job, review the execution role’s data access permissions, and implement access controls to prevent arbitrary container overrides (e.g., conditional batch:SubmitJob controls on image and queue ARNs). The rule requires CloudTrail to be enabled and properly configured to collect Batch events for effective detection.