AWS Service Quotas Multi-Region GetServiceQuota Requests

  1[metadata]
  2creation_date = "2024/08/26"
  3maturity = "production"
  4updated_date = "2026/01/16"
  5
  6[rule]
  7author = ["Elastic"]
  8description = """
  9Identifies when a single AWS principal makes GetServiceQuota API calls for the EC2 service quota L-1216C47A, across more
 10than 10 AWS regions within a 30-second window. This quota represents the vCPU limit for on-demand EC2 instances.
 11Adversaries commonly enumerate this quota across regions to assess capacity for large-scale instance deployment,
 12including cryptocurrency mining, malware hosting, or command-and-control infrastructure. This behavior may indicate
 13cloud infrastructure discovery using compromised credentials or a compromised workload.
 14"""
 15false_positives = [
 16    """
 17    Organizations with mature multi-region operations may legitimately query EC2 service quotas across regions for
 18    capacity planning, automation, or compliance validation. Infrastructure-as-code tooling, quota monitoring solutions,
 19    or centralized cloud governance platforms may also generate similar activity. Validate the identity, purpose, and
 20    historical behavior of the calling principal before treating this activity as malicious.
 21    """,
 22]
 23from = "now-6m"
 24language = "esql"
 25license = "Elastic License v2"
 26name = "AWS Service Quotas Multi-Region GetServiceQuota Requests"
 27note = """## Triage and analysis
 28
 29### Investigating AWS Service Quotas Multi-Region GetServiceQuota Requests
 30
 31AWS Service Quotas define usage limits for AWS services and are commonly referenced during capacity planning or automation. However, adversaries frequently enumerate EC2 on-demand instance quotas across many regions to identify where they can rapidly deploy compute resources for malicious purposes such as cryptocurrency mining, botnet hosting, or malware staging. This rule detects unusually fast, multi-region enumeration of the EC2 on-demand vCPU quota (`L-1216C47A`), a pattern that is uncommon for normal administrative activity and strongly associated with cloud infrastructure discovery.
 32
 33### Possible investigation steps
 34
 35**Identify the actor**
 36- Review `aws.cloudtrail.user_identity.arn` and `aws.cloudtrail.user_identity.access_key_id` to determine whether the requests originated from an IAM user, role, or assumed role. Validate whether this principal is expected to perform quota discovery or capacity analysis across many regions.
 37
 38**Evaluate the scope of discovery**
 39- Review the `cloud.region` values to determine which regions were queried and whether they align with regions normally used by your organization. Rapid enumeration of rarely used or disabled regions increases suspicion.
 40
 41**Inspect request origin and tooling**
 42- Review `source.ip`, `source.as.organization.name`, and `user_agent.original` to determine whether the activity originated from a trusted corporate network, known cloud automation environment, or an unexpected hosting provider or VPN.
 43- Unexpected user agents or hosting providers may indicate compromised credentials or an attacker-controlled instance.
 44
 45**Correlate with follow-on activity**
 46- Search for subsequent EC2-related actions such as `RunInstances`, `RequestSpotInstances`, `CreateLaunchTemplate`, or `ModifyInstanceAttribute` following the quota discovery.
 47- Review recent IAM activity for the same principal, including access key creation, role assumptions, or policy changes.
 48
 49**Assess intent and risk**
 50- Determine whether this activity aligns with a known operational task (capacity planning, onboarding, automation testing), or whether it represents unexplained reconnaissance behavior.
 51- If the principal is newly created, rarely used, or exhibiting other anomalous behavior, treat this as high risk.
 52
 53### False positive analysis
 54- Multi-region quota discovery may be legitimate in organizations with global deployments, centralized cloud governance, or automated capacity monitoring.
 55- Infrastructure-as-code pipelines, quota management tools, or internal cloud platforms may periodically enumerate quotas.
 56
 57### Response and remediation
 58- If the activity is unauthorized or suspicious, immediately rotate or disable access keys associated with the principal and revoke active sessions.
 59- Review CloudTrail activity for evidence of follow-on abuse, particularly EC2 instance launches, network changes, or IAM modifications.
 60- Apply tighter IAM permissions to restrict access to Service Quotas APIs where not explicitly required.
 61- Enforce MFA on IAM users and consider conditional access controls (such as source IP or VPC restrictions) for sensitive roles.
 62- Notify security operations and cloud platform teams to assess potential impact and determine whether containment actions (such as SCP enforcement or account isolation) are required.
 63- Update detection coverage to monitor for EC2 provisioning attempts following quota discovery to catch resource abuse early.
 64
 65### Additional information
 66- **[AWS IR Playbooks](https://github.com/aws-samples/aws-incident-response-playbooks/blob/c151b0dc091755fffd4d662a8f29e2f6794da52c/playbooks/)** 
 67- **[AWS Customer Playbook Framework](https://github.com/aws-samples/aws-customer-playbook-framework/tree/a8c7b313636b406a375952ac00b2d68e89a991f2/docs)** 
 68- **[AWS Knowledge Center – Security Best Practices](https://aws.amazon.com/premiumsupport/knowledge-center/security-best-practices/)**
 69"""
 70references = [
 71    "https://www.sentinelone.com/labs/exploring-fbot-python-based-malware-targeting-cloud-and-payment-services/",
 72    "https://docs.aws.amazon.com/servicequotas/2019-06-24/apireference/API_GetServiceQuota.html",
 73]
 74risk_score = 21
 75rule_id = "19be0164-63d2-11ef-8e38-f661ea17fbce"
 76severity = "low"
 77tags = [
 78    "Domain: Cloud",
 79    "Data Source: AWS",
 80    "Data Source: Amazon Web Services",
 81    "Data Source: AWS Service Quotas",
 82    "Use Case: Threat Detection",
 83    "Tactic: Discovery",
 84    "Resources: Investigation Guide",
 85]
 86timestamp_override = "event.ingested"
 87type = "esql"
 88
 89query = '''
 90from logs-aws.cloudtrail-* METADATA _id, _version, _index
 91
 92// filter for GetServiceQuota API calls
 93| where
 94  event.dataset == "aws.cloudtrail"
 95  and event.provider == "servicequotas.amazonaws.com"
 96  and event.action == "GetServiceQuota"
 97
 98// truncate the timestamp to a 30-second window
 99| eval Esql.time_window_date_trunc = date_trunc(30 seconds, @timestamp)
100
101// dissect request parameters to extract service and quota code
102| dissect aws.cloudtrail.request_parameters "{%{?Esql.aws_cloudtrail_request_parameters_service_code_key}=%{Esql.aws_cloudtrail_request_parameters_service_code}, %{?quota_code_key}=%{Esql.aws_cloudtrail_request_parameters_quota_code}}"
103
104// filter for EC2 service quota L-1216C47A (vCPU on-demand instances)
105| where Esql.aws_cloudtrail_request_parameters_service_code == "ec2" and Esql.aws_cloudtrail_request_parameters_quota_code == "L-1216C47A"
106
107// keep only the relevant fields
108| keep
109    Esql.time_window_date_trunc,
110    aws.cloudtrail.user_identity.arn,
111    cloud.region,
112    Esql.aws_cloudtrail_request_parameters_service_code,
113    Esql.aws_cloudtrail_request_parameters_quota_code,
114    aws.cloudtrail.request_parameters,
115    @timestamp, 
116    aws.cloudtrail.user_identity.type, 
117    aws.cloudtrail.user_identity.access_key_id, 
118    source.ip, 
119    cloud.account.id, 
120    user_agent.original, 
121    source.as.organization.name, 
122    data_stream.namespace
123    
124// count the number of unique regions and total API calls within the time window
125| stats
126    Esql.cloud_region_count_distinct = count_distinct(cloud.region),
127    Esql.event_count = count(*),
128    Esql.aws_cloudtrail_request_parameters_values = VALUES(aws.cloudtrail.request_parameters),
129    Esql.event_timestamp_values = VALUES(@timestamp),
130    Esql.aws_cloudtrail_user_identity_type_values = VALUES(aws.cloudtrail.user_identity.type),
131    Esql.aws_cloudtrail_user_identity_access_key_id_values = VALUES(aws.cloudtrail.user_identity.access_key_id),
132    Esql.source_ip_values = VALUES(source.ip),
133    Esql.cloud_account_id_values = VALUES(cloud.account.id),
134    Esql.user_agent_original_values = VALUES(user_agent.original),
135    Esql.source_as_organization_name_values = VALUES(source.as.organization.name),
136    Esql.cloud_region_values = VALUES(cloud.region),
137    Esql.data_stream_namespace_values = VALUES(data_stream.namespace)
138  by Esql.time_window_date_trunc, aws.cloudtrail.user_identity.arn
139
140// filter for API calls in more than 10 regions within the 30-second window
141| where
142  Esql.cloud_region_count_distinct >= 10
143  and Esql.event_count >= 10
144'''
145
146
147[[rule.threat]]
148framework = "MITRE ATT&CK"
149[[rule.threat.technique]]
150id = "T1580"
151name = "Cloud Infrastructure Discovery"
152reference = "https://attack.mitre.org/techniques/T1580/"
153
154
155[rule.threat.tactic]
156id = "TA0007"
157name = "Discovery"
158reference = "https://attack.mitre.org/tactics/TA0007/"
159
160[rule.investigation_fields]
161field_names = [
162    "Esql.cloud_region_count_distinct",
163    "Esql.event_count",
164    "Esql.time_window_date_trunc",
165    "Esql.event_timestamp_values",
166    "aws.cloudtrail.user_identity.arn",
167    "Esql.aws_cloudtrail_user_identity_type_values",
168    "Esql.aws_cloudtrail_user_identity_access_key_id_values",
169    "Esql.source_ip_values",
170    "Esql.source_as_organization_name_values",
171    "Esql.user_agent_original_values",
172    "Esql.cloud_account_id_values",
173    "Esql.cloud_region_values",
174    "Esql.data_stream_namespace_values",
175]