Technique.View on attack.mitre.org
Adversaries may create cloud instances in unused geographic service regions in order to evade detection. Access is usually obtained through compromising accounts used to manage cloud infrastructure.
Cloud service providers often provide infrastructure throughout the world in order to improve performance, provide redundancy, and allow customers to meet compliance requirements. Oftentimes, a customer will only use a subset of the available regions and may not actively monitor other regions. If an adversary creates resources in an unused region, they may be able to operate undetected.
A variation on this behavior takes advantage of differences in functionality across cloud regions. An adversary could utilize regions which do not support advanced detection services in order to avoid detection of their activity.
An example of adversary use of unused AWS regions is to mine cryptocurrency through Resource Hijacking, which can cost organizations substantial amounts of money over time depending on the processing power used.
Rules on DetectionCode tagged with T1535.
| Rule | Type | Risk | Data source |
|---|---|---|---|
| AWS Cloud Provisioning From Previously Unseen City | Anomaly | NULL | |
| AWS Cloud Provisioning From Previously Unseen Country | Anomaly | NULL | |
| AWS Cloud Provisioning From Previously Unseen Region | Anomaly | NULL | |
| AWS Successful Console Authentication From Multiple IPs | Anomaly | NULL | AWS CloudTrail ConsoleLogin |
| Cloud Compute Instance Created In Previously Unused Region | Anomaly | NULL | AWS CloudTrail |
| Detect AWS Console Login by User from New City | Hunting | NULL | AWS CloudTrail |
| Detect AWS Console Login by User from New Country | Hunting | NULL | AWS CloudTrail |
| Detect AWS Console Login by User from New Region | Hunting | NULL | AWS CloudTrail |
| EC2 Instance Started In Previously Unseen Region | Hunting | NULL |
None recorded.
None recorded.
None recorded.
Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.
