AWS Service Quotas Multi-Region GetServiceQuota
Requests
Identifies when a single AWS resource is making GetServiceQuota
API calls for the EC2 service quota L-1216C47A in more
than 10 regions within a 30-second window. Quota code L-1216C47A represents on-demand instances which are used by
adversaries to deploy malware and mine cryptocurrency. This could indicate a potential threat actor attempting to
discover the AWS infrastructure across multiple regions using compromised credentials or a compromised instance.
Elastic rule (View on GitHub)
1[metadata]
2creation_date = "2024/08/26"
3maturity = "production"
4updated_date = "2025/07/16"
5
6[rule]
7author = ["Elastic"]
8description = """
9Identifies when a single AWS resource is making `GetServiceQuota` API calls for the EC2 service quota L-1216C47A in more
10than 10 regions within a 30-second window. Quota code L-1216C47A represents on-demand instances which are used by
11adversaries to deploy malware and mine cryptocurrency. This could indicate a potential threat actor attempting to
12discover the AWS infrastructure across multiple regions using compromised credentials or a compromised instance.
13"""
14from = "now-9m"
15language = "esql"
16license = "Elastic License v2"
17name = "AWS Service Quotas Multi-Region `GetServiceQuota` Requests"
18note = """## Triage and analysis
19
20> **Disclaimer**:
21> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.
22
23### Investigating AWS Service Quotas Multi-Region `GetServiceQuota` Requests
24
25AWS Service Quotas manage resource limits across AWS services, crucial for maintaining operational boundaries. Adversaries may exploit `GetServiceQuota` API calls to probe AWS infrastructure, seeking vulnerabilities for deploying threats like cryptocurrency miners. The detection rule identifies unusual multi-region queries for EC2 quotas, signaling potential credential compromise or unauthorized access attempts.
26
27### Possible investigation steps
28
29- Review the AWS CloudTrail logs to identify the specific user or role associated with the `aws.cloudtrail.user_identity.arn` field that triggered the alert. Determine if this user or role should have access to multiple regions.
30- Examine the `cloud.region` field to identify which regions were accessed and verify if these regions are typically used by your organization. Investigate any unfamiliar regions for unauthorized activity.
31- Check the AWS IAM policies and permissions associated with the identified user or role to ensure they align with the principle of least privilege. Look for any recent changes or anomalies in permissions.
32- Investigate the source IP addresses and locations from which the `GetServiceQuota` API calls were made to determine if they match expected patterns for your organization. Look for any unusual or suspicious IP addresses.
33- Review recent activity logs for the identified user or role to detect any other unusual or unauthorized actions, such as attempts to launch EC2 instances or access other AWS services.
34- If a compromise is suspected, consider rotating the credentials for the affected user or role and implementing additional security measures, such as multi-factor authentication (MFA) and enhanced monitoring.
35
36### False positive analysis
37
38- Legitimate multi-region operations: Organizations with a global presence may have legitimate reasons for querying EC2 service quotas across multiple regions. To handle this, users can create exceptions for known accounts or roles that regularly perform such operations.
39- Automated infrastructure management tools: Some tools or scripts designed for infrastructure management might perform multi-region `GetServiceQuota` requests as part of their normal operation. Users should identify these tools and exclude their activity from triggering alerts by whitelisting their associated user identities or ARNs.
40- Testing and development activities: Developers or testers might intentionally perform multi-region queries during testing phases. Users can mitigate false positives by setting up temporary exceptions for specific time frames or user identities involved in testing.
41- Cloud service providers or partners: Third-party services or partners managing AWS resources on behalf of an organization might generate similar patterns. Users should establish trust relationships and exclude these entities from detection by verifying their activities and adding them to an exception list.
42
43### Response and remediation
44
45- Immediately isolate the AWS account or IAM user identified in the alert to prevent further unauthorized access. This can be done by disabling the access keys or suspending the account temporarily.
46- Conduct a thorough review of the AWS CloudTrail logs for the identified user or resource to determine the extent of the unauthorized activity and identify any other potentially compromised resources.
47- Rotate all access keys and passwords associated with the compromised account or IAM user to prevent further unauthorized access.
48- Implement additional security measures such as enabling multi-factor authentication (MFA) for all IAM users and roles to enhance account security.
49- Notify the security operations team and relevant stakeholders about the potential compromise and the steps being taken to remediate the issue.
50- If evidence of compromise is confirmed, consider engaging AWS Support or a third-party incident response team for further investigation and assistance.
51- Review and update IAM policies and permissions to ensure the principle of least privilege is enforced, reducing the risk of future unauthorized access attempts."""
52references = [
53 "https://www.sentinelone.com/labs/exploring-fbot-python-based-malware-targeting-cloud-and-payment-services/",
54 "https://docs.aws.amazon.com/servicequotas/2019-06-24/apireference/API_GetServiceQuota.html",
55]
56risk_score = 21
57rule_id = "19be0164-63d2-11ef-8e38-f661ea17fbce"
58severity = "low"
59tags = [
60 "Domain: Cloud",
61 "Data Source: AWS",
62 "Data Source: Amazon Web Services",
63 "Data Source: AWS Service Quotas",
64 "Use Case: Threat Detection",
65 "Tactic: Discovery",
66 "Resources: Investigation Guide",
67]
68timestamp_override = "event.ingested"
69type = "esql"
70
71query = '''
72from logs-aws.cloudtrail-*
73
74// filter for GetServiceQuota API calls
75| where
76 event.dataset == "aws.cloudtrail"
77 and event.provider == "servicequotas.amazonaws.com"
78 and event.action == "GetServiceQuota"
79
80// truncate the timestamp to a 30-second window
81| eval Esql.time_window_date_trunc = date_trunc(30 seconds, @timestamp)
82
83// dissect request parameters to extract service and quota code
84| dissect aws.cloudtrail.request_parameters "{%{?Esql.aws_cloudtrail_request_parameters_service_code_key}=%{Esql.aws_cloudtrail_request_parameters_service_code}, %{?quota_code_key}=%{Esql.aws_cloudtrail_request_parameters_quota_code}}"
85
86// filter for EC2 service quota L-1216C47A (vCPU on-demand instances)
87| where Esql.aws_cloudtrail_request_parameters_service_code == "ec2" and Esql.aws_cloudtrail_request_parameters_quota_code == "L-1216C47A"
88
89// keep only the relevant fields
90| keep
91 Esql.time_window_date_trunc,
92 aws.cloudtrail.user_identity.arn,
93 cloud.region,
94 Esql.aws_cloudtrail_request_parameters_service_code,
95 Esql.aws_cloudtrail_request_parameters_quota_code
96
97// count the number of unique regions and total API calls within the time window
98| stats
99 Esql.cloud_region_count_distinct = count_distinct(cloud.region),
100 Esql.event_count = count(*)
101 by Esql.time_window_date_trunc, aws.cloudtrail.user_identity.arn
102
103// filter for API calls in more than 10 regions within the 30-second window
104| where
105 Esql.cloud_region_count_distinct >= 10
106 and Esql.event_count >= 10
107
108// sort by time window descending
109| sort Esql.time_window_date_trunc desc
110'''
111
112
113[[rule.threat]]
114framework = "MITRE ATT&CK"
115[[rule.threat.technique]]
116id = "T1580"
117name = "Cloud Infrastructure Discovery"
118reference = "https://attack.mitre.org/techniques/T1580/"
119
120
121[rule.threat.tactic]
122id = "TA0007"
123name = "Discovery"
124reference = "https://attack.mitre.org/tactics/TA0007/"
Triage and analysis
Disclaimer: This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.
Investigating AWS Service Quotas Multi-Region GetServiceQuota
Requests
AWS Service Quotas manage resource limits across AWS services, crucial for maintaining operational boundaries. Adversaries may exploit GetServiceQuota
API calls to probe AWS infrastructure, seeking vulnerabilities for deploying threats like cryptocurrency miners. The detection rule identifies unusual multi-region queries for EC2 quotas, signaling potential credential compromise or unauthorized access attempts.
Possible investigation steps
- Review the AWS CloudTrail logs to identify the specific user or role associated with the
aws.cloudtrail.user_identity.arn
field that triggered the alert. Determine if this user or role should have access to multiple regions. - Examine the
cloud.region
field to identify which regions were accessed and verify if these regions are typically used by your organization. Investigate any unfamiliar regions for unauthorized activity. - Check the AWS IAM policies and permissions associated with the identified user or role to ensure they align with the principle of least privilege. Look for any recent changes or anomalies in permissions.
- Investigate the source IP addresses and locations from which the
GetServiceQuota
API calls were made to determine if they match expected patterns for your organization. Look for any unusual or suspicious IP addresses. - Review recent activity logs for the identified user or role to detect any other unusual or unauthorized actions, such as attempts to launch EC2 instances or access other AWS services.
- If a compromise is suspected, consider rotating the credentials for the affected user or role and implementing additional security measures, such as multi-factor authentication (MFA) and enhanced monitoring.
False positive analysis
- Legitimate multi-region operations: Organizations with a global presence may have legitimate reasons for querying EC2 service quotas across multiple regions. To handle this, users can create exceptions for known accounts or roles that regularly perform such operations.
- Automated infrastructure management tools: Some tools or scripts designed for infrastructure management might perform multi-region
GetServiceQuota
requests as part of their normal operation. Users should identify these tools and exclude their activity from triggering alerts by whitelisting their associated user identities or ARNs. - Testing and development activities: Developers or testers might intentionally perform multi-region queries during testing phases. Users can mitigate false positives by setting up temporary exceptions for specific time frames or user identities involved in testing.
- Cloud service providers or partners: Third-party services or partners managing AWS resources on behalf of an organization might generate similar patterns. Users should establish trust relationships and exclude these entities from detection by verifying their activities and adding them to an exception list.
Response and remediation
- Immediately isolate the AWS account or IAM user identified in the alert to prevent further unauthorized access. This can be done by disabling the access keys or suspending the account temporarily.
- Conduct a thorough review of the AWS CloudTrail logs for the identified user or resource to determine the extent of the unauthorized activity and identify any other potentially compromised resources.
- Rotate all access keys and passwords associated with the compromised account or IAM user to prevent further unauthorized access.
- Implement additional security measures such as enabling multi-factor authentication (MFA) for all IAM users and roles to enhance account security.
- Notify the security operations team and relevant stakeholders about the potential compromise and the steps being taken to remediate the issue.
- If evidence of compromise is confirmed, consider engaging AWS Support or a third-party incident response team for further investigation and assistance.
- Review and update IAM policies and permissions to ensure the principle of least privilege is enforced, reducing the risk of future unauthorized access attempts.
References
Related rules
- AWS Discovery API Calls via CLI from a Single Resource
- AWS EC2 EBS Snapshot Access Removed
- AWS EC2 EBS Snapshot Shared or Made Public
- AWS EC2 Multi-Region DescribeInstances API Calls
- AWS S3 Object Encryption Using External KMS Key