AWS Service Quotas Multi-Region GetServiceQuota Requests

  1[metadata]
  2creation_date = "2024/08/26"
  3maturity = "production"
  4updated_date = "2025/12/15"
  5
  6[rule]
  7author = ["Elastic"]
  8description = """
  9Identifies when a single AWS principal makes GetServiceQuota API calls for the EC2 service quota L-1216C47A, across more
 10than 10 AWS regions within a 30-second window. This quota represents the vCPU limit for on-demand EC2 instances.
 11Adversaries commonly enumerate this quota across regions to assess capacity for large-scale instance deployment,
 12including cryptocurrency mining, malware hosting, or command-and-control infrastructure. This behavior may indicate
 13cloud infrastructure discovery using compromised credentials or a compromised workload.
 14"""
 15false_positives = [
 16    """
 17    Organizations with mature multi-region operations may legitimately query EC2 service quotas across regions for
 18    capacity planning, automation, or compliance validation. Infrastructure-as-code tooling, quota monitoring solutions,
 19    or centralized cloud governance platforms may also generate similar activity. Validate the identity, purpose, and
 20    historical behavior of the calling principal before treating this activity as malicious.
 21    """,
 22]
 23from = "now-6m"
 24language = "esql"
 25license = "Elastic License v2"
 26name = "AWS Service Quotas Multi-Region GetServiceQuota Requests"
 27note = """## Triage and analysis
 28
 29> **Disclaimer**:
 30> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.
 31
 32### Investigating AWS Service Quotas Multi-Region GetServiceQuota Requests
 33
 34AWS Service Quotas define usage limits for AWS services and are commonly referenced during capacity planning or automation. However, adversaries frequently enumerate EC2 on-demand instance quotas across many regions to identify where they can rapidly deploy compute resources for malicious purposes such as cryptocurrency mining, botnet hosting, or malware staging. This rule detects unusually fast, multi-region enumeration of the EC2 on-demand vCPU quota (`L-1216C47A`), a pattern that is uncommon for normal administrative activity and strongly associated with cloud infrastructure discovery.
 35
 36### Possible investigation steps
 37
 38**Identify the actor**
 39- Review `aws.cloudtrail.user_identity.arn` and `aws.cloudtrail.user_identity.access_key_id` to determine whether the requests originated from an IAM user, role, or assumed role. Validate whether this principal is expected to perform quota discovery or capacity analysis across many regions.
 40
 41**Evaluate the scope of discovery**
 42- Review the `cloud.region` values to determine which regions were queried and whether they align with regions normally used by your organization. Rapid enumeration of rarely used or disabled regions increases suspicion.
 43
 44**Inspect request origin and tooling**
 45- Review `source.ip`, `source.as.organization.name`, and `user_agent.original` to determine whether the activity originated from a trusted corporate network, known cloud automation environment, or an unexpected hosting provider or VPN.
 46- Unexpected user agents or hosting providers may indicate compromised credentials or an attacker-controlled instance.
 47
 48**Correlate with follow-on activity**
 49- Search for subsequent EC2-related actions such as `RunInstances`, `RequestSpotInstances`, `CreateLaunchTemplate`, or `ModifyInstanceAttribute` following the quota discovery.
 50- Review recent IAM activity for the same principal, including access key creation, role assumptions, or policy changes.
 51
 52**Assess intent and risk**
 53- Determine whether this activity aligns with a known operational task (capacity planning, onboarding, automation testing), or whether it represents unexplained reconnaissance behavior.
 54- If the principal is newly created, rarely used, or exhibiting other anomalous behavior, treat this as high risk.
 55
 56### False positive analysis
 57- Multi-region quota discovery may be legitimate in organizations with global deployments, centralized cloud governance, or automated capacity monitoring.
 58- Infrastructure-as-code pipelines, quota management tools, or internal cloud platforms may periodically enumerate quotas.
 59
 60### Response and remediation
 61- If the activity is unauthorized or suspicious, immediately rotate or disable access keys associated with the principal and revoke active sessions.
 62- Review CloudTrail activity for evidence of follow-on abuse, particularly EC2 instance launches, network changes, or IAM modifications.
 63- Apply tighter IAM permissions to restrict access to Service Quotas APIs where not explicitly required.
 64- Enforce MFA on IAM users and consider conditional access controls (such as source IP or VPC restrictions) for sensitive roles.
 65- Notify security operations and cloud platform teams to assess potential impact and determine whether containment actions (such as SCP enforcement or account isolation) are required.
 66- Update detection coverage to monitor for EC2 provisioning attempts following quota discovery to catch resource abuse early.
 67
 68### Additional information
 69- **[AWS IR Playbooks](https://github.com/aws-samples/aws-incident-response-playbooks/blob/c151b0dc091755fffd4d662a8f29e2f6794da52c/playbooks/)** 
 70- **[AWS Customer Playbook Framework](https://github.com/aws-samples/aws-customer-playbook-framework/tree/a8c7b313636b406a375952ac00b2d68e89a991f2/docs)** 
 71- **[AWS Knowledge Center – Security Best Practices](https://aws.amazon.com/premiumsupport/knowledge-center/security-best-practices/)**
 72"""
 73references = [
 74    "https://www.sentinelone.com/labs/exploring-fbot-python-based-malware-targeting-cloud-and-payment-services/",
 75    "https://docs.aws.amazon.com/servicequotas/2019-06-24/apireference/API_GetServiceQuota.html",
 76]
 77risk_score = 21
 78rule_id = "19be0164-63d2-11ef-8e38-f661ea17fbce"
 79severity = "low"
 80tags = [
 81    "Domain: Cloud",
 82    "Data Source: AWS",
 83    "Data Source: Amazon Web Services",
 84    "Data Source: AWS Service Quotas",
 85    "Use Case: Threat Detection",
 86    "Tactic: Discovery",
 87    "Resources: Investigation Guide",
 88]
 89timestamp_override = "event.ingested"
 90type = "esql"
 91
 92query = '''
 93from logs-aws.cloudtrail-* METADATA _id, _version, _index
 94
 95// filter for GetServiceQuota API calls
 96| where
 97  event.dataset == "aws.cloudtrail"
 98  and event.provider == "servicequotas.amazonaws.com"
 99  and event.action == "GetServiceQuota"
100
101// truncate the timestamp to a 30-second window
102| eval Esql.time_window_date_trunc = date_trunc(30 seconds, @timestamp)
103
104// dissect request parameters to extract service and quota code
105| dissect aws.cloudtrail.request_parameters "{%{?Esql.aws_cloudtrail_request_parameters_service_code_key}=%{Esql.aws_cloudtrail_request_parameters_service_code}, %{?quota_code_key}=%{Esql.aws_cloudtrail_request_parameters_quota_code}}"
106
107// filter for EC2 service quota L-1216C47A (vCPU on-demand instances)
108| where Esql.aws_cloudtrail_request_parameters_service_code == "ec2" and Esql.aws_cloudtrail_request_parameters_quota_code == "L-1216C47A"
109
110// keep only the relevant fields
111| keep
112    Esql.time_window_date_trunc,
113    aws.cloudtrail.user_identity.arn,
114    cloud.region,
115    Esql.aws_cloudtrail_request_parameters_service_code,
116    Esql.aws_cloudtrail_request_parameters_quota_code,
117    aws.cloudtrail.request_parameters,
118    @timestamp, 
119    aws.cloudtrail.user_identity.type, 
120    aws.cloudtrail.user_identity.access_key_id, 
121    source.ip, 
122    cloud.account.id, 
123    user_agent.original, 
124    source.as.organization.name, 
125    data_stream.namespace
126    
127// count the number of unique regions and total API calls within the time window
128| stats
129    Esql.cloud_region_count_distinct = count_distinct(cloud.region),
130    Esql.event_count = count(*),
131    Esql.aws_cloudtrail_request_parameters_values = VALUES(aws.cloudtrail.request_parameters),
132    Esql.event_timestamp_values = VALUES(@timestamp),
133    Esql.aws_cloudtrail_user_identity_type_values = VALUES(aws.cloudtrail.user_identity.type),
134    Esql.aws_cloudtrail_user_identity_access_key_id_values = VALUES(aws.cloudtrail.user_identity.access_key_id),
135    Esql.source_ip_values = VALUES(source.ip),
136    Esql.cloud_account_id_values = VALUES(cloud.account.id),
137    Esql.user_agent_original_values = VALUES(user_agent.original),
138    Esql.source_as_organization_name_values = VALUES(source.as.organization.name),
139    Esql.cloud_region_values = VALUES(cloud.region),
140    Esql.data_stream_namespace_values = VALUES(data_stream.namespace)
141  by Esql.time_window_date_trunc, aws.cloudtrail.user_identity.arn
142
143// filter for API calls in more than 10 regions within the 30-second window
144| where
145  Esql.cloud_region_count_distinct >= 10
146  and Esql.event_count >= 10
147'''
148
149
150[[rule.threat]]
151framework = "MITRE ATT&CK"
152[[rule.threat.technique]]
153id = "T1580"
154name = "Cloud Infrastructure Discovery"
155reference = "https://attack.mitre.org/techniques/T1580/"
156
157
158[rule.threat.tactic]
159id = "TA0007"
160name = "Discovery"
161reference = "https://attack.mitre.org/tactics/TA0007/"
162
163[rule.investigation_fields]
164field_names = [
165    "Esql.cloud_region_count_distinct",
166    "Esql.event_count",
167    "Esql.time_window_date_trunc",
168    "Esql.event_timestamp_values",
169    "aws.cloudtrail.user_identity.arn",
170    "Esql.aws_cloudtrail_user_identity_type_values",
171    "Esql.aws_cloudtrail_user_identity_access_key_id_values",
172    "Esql.source_ip_values",
173    "Esql.source_as_organization_name_values",
174    "Esql.user_agent_original_values",
175    "Esql.cloud_account_id_values",
176    "Esql.cloud_region_values",
177    "Esql.data_stream_namespace_values",
178]