Unused/Unsupported Cloud Regions T1535

Tactic: Stealth

Adversaries may create cloud instances in unused geographic service regions in order to evade detection. Access is usually obtained through compromising accounts used to manage cloud infrastructure.

Authoring guide

These 10 rules share fields, values, and exclusions.

Fields filtered most (16 distinct)

These fields appear most often in rule filters.

FieldRulesHowSample values
signature3eq 3consolelogin
aws::eventName2eq 2EnableRegion, consolelogin
All_Changes.action1eq 1created
EventID1eq 1DisableRegion, EnableRegion
aws::eventSource1eq 1ecr.amazonaws.com
awsRegion1in 1ap-east-1, eu-central-1, eu-west-3
distinct_ip_count1gt 11
enough_data1eq 11
firstTimeSeenRegion1is_null 1
protoPayload.methodName1ends_with 1create, insert
readOnly1eq 1false
security_result.action1eq 1ALLOW
sourcetype1eq 1aws:cloudtrail
userCity1eq 1new city
userCountry1eq 1new country

Top indicator values (20 distinct)

These values appear most often in rule predicates.

FieldKindValueRules (here)Corpus reach
signatureeq
consolelogin
34
All_Changes.actioneq
created
111
EventIDeq
DisableRegion
1
EventIDeq
EnableRegion
1
aws::eventNameeq
EnableRegion
1
aws::eventNameeq
consolelogin
119
aws::eventSourceeq
ecr.amazonaws.com
17
awsRegionin
ap-east-1
1
awsRegionin
eu-central-1
1
awsRegionin
eu-west-3
1
distinct_ip_countgt
1
14
enough_dataeq
1
110
protoPayload.methodNameends_with
create
1
protoPayload.methodNameends_with
insert
1
readOnlyeq
false
1
security_result.actioneq
ALLOW
1102
sourcetypeeq
aws:cloudtrail
159
userCityeq
new city
1
userCountryeq
new country
1
userRegioneq
new region
1

Rules under this technique

These vendors publish rules tagged with this technique.

Domain: Cloud

Platform (all)

Splunk 5 rules

YARA-L 1 rule

Panther 4 rules