Techniques › T1535 › AN0690
AN0690 Analytic 0690
IaaS · attack.mitre.org · ATT&CK Enterprise v19.2
<p>Detects creation of cloud instances, services, or resources in normally unused or unsupported regions, especially following initial account access or credential use from known regions. Correlates resource provisioning across regions with absence of historical usage and alerting from standard logging services (e.g., GuardDuty not enabled in that region).</p>
- Detects
- T1535 Unused/Unsupported Cloud Regions
- Part of
- DET0247 Detection of Adversary Use of Unused or Unsupported Cloud Regions (IaaS)
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| AWS:CloudTrail | RunInstances | DC0080 Instance Start |
| AWS:CloudTrail | CreateBucket | DC0024 Cloud Storage Creation |
| CloudTrail:GetCallerIdentity | GetCallerIdentity | DC0013 User Account Metadata |
| AWS:VPCFlowLogs | High outbound traffic from new region resource | DC0082 Network Connection Creation |
Mutable elements
Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.
| Field | Description |
|---|---|
UnusedRegionList | List of regions historically unused by the organization (can vary per tenant/project) |
TimeWindow | Time interval for correlating activity following account access |
AllowedServiceList | Whitelist of services allowed in secondary/DR regions |
OutboundTrafficThreshold | Volume threshold to flag suspicious outbound activity |