Sunturai
Back to results
MediumMicrosoft Sentinel analytics

AWSCloudTrail - Suspicious AWS EC2 Compute Resource Deployments

This detection focused on Suspicious deployment of AWS EC2 resource (virtual machine) scale sets was detected. This behavior might indicate that the threat actor is deploying computing resources for cryptocurrency…

Description

This detection focused on Suspicious deployment of AWS EC2 resource (virtual machine) scale sets was detected. This behavior might indicate that the threat actor is deploying computing resources for cryptocurrency mining activities.This detection centers around identifying suspicious instances of AWS EC2 resource deployment, particularly scale sets. Such behavior raises concerns of potential threat actor involvement, potentially indicative of efforts to deploy computing resources for the purpose of cryptocurrency mining activities.

Detection logic

Detection requirements

Platform
ContainersIaaSLinuxmacOSSaaSWindows

The rule states no platform. This is derived from the ATT&CK technique it maps to.

Log source product
aws
Log source service
awscloudtrail

Detections can measure how the public catalogue is used — which detections people look for, and which pages bring them here. It sets a cookie that recognises this browser for 180 days. It is never linked to an account and never follows you to other sites. Privacy notice