AWS Service Quota Increase Requested by Rare Identity

  1[metadata]
  2creation_date = "2026/08/24"
  3integration = ["aws"]
  4maturity = "production"
  5updated_date = "2026/08/24"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Detects the first time an AWS identity requests a service quota increase via the AWS Service
 11Quotas API within a 7-day history window. Service quota increases are submitted to AWS Support
 12and, when approved, raise the limits on EC2 instances, Lambda concurrency, VPC resources, and
 13other services. An adversary who obtains AWS credentials may request quota increases as
 14infrastructure preparation for large-scale cryptomining, DDoS amplification, phishing
 15campaigns, or data exfiltration operations that require compute or network resources beyond
 16the account's current limits.
 17"""
 18false_positives = [
 19    """
 20    Cloud infrastructure teams requesting quota increases for planned capacity expansions,
 21    new region deployments, or scaling events will trigger this rule. Validate the requested
 22    service and limit against your infrastructure roadmap before closing.
 23    """,
 24]
 25from = "now-6m"
 26index = ["logs-aws.cloudtrail-*"]
 27language = "kuery"
 28license = "Elastic License v2"
 29name = "AWS Service Quota Increase Requested by Rare Identity"
 30note = """## Triage and analysis
 31
 32### Investigating AWS Service Quota Increase Requested by Rare Identity
 33
 34AWS Service Quotas (formerly Service Limits) cap how many resources of each type an account can create. Default limits exist to prevent accidental runaway provisioning, but an adversary who requests an increase can scale operations far beyond what the default limits allow: requesting 1000 EC2 On-Demand vCPUs enables cryptomining at industrial scale; requesting higher SES sending limits enables large-scale phishing campaigns; requesting higher Lambda concurrency enables large-scale credential-stuffing operations.
 35
 36### Possible investigation steps
 37
 38- Identify the caller from aws.cloudtrail.user_identity.arn and user.name.
 39- Review aws.cloudtrail.request_parameters for the serviceCode (which AWS service), the quotaCode (which specific limit), and the requested value.
 40- Determine whether the requested quota increase aligns with a known infrastructure project.
 41- Check whether the same identity has recently created resources in the service being scaled (EC2 RunInstances, Lambda CreateFunction, SES SendEmail).
 42- Review whether this is the first quota increase request for this service from this identity or a continuation of a known capacity planning effort.
 43
 44### Response and remediation
 45
 46- If unauthorized, submit a cancellation request to AWS Support for the quota increase.
 47- Revoke active sessions for the requesting identity.
 48- Apply an SCP restricting servicequotas:RequestServiceQuotaIncrease to approved cloud-operations roles that require prior approval.
 49"""
 50references = [
 51    "https://docs.aws.amazon.com/servicequotas/2019-06-24/apireference/API_RequestServiceQuotaIncrease.html",
 52    "https://www.rapid7.com/blog/post/dr-threat-actors-aws-workmail-phishing-campaigns/",
 53]
 54risk_score = 47
 55rule_id = "7e1b0654-b6c0-4b1b-ab47-75588533083c"
 56setup = "The AWS integration must be ingesting management events into `logs-aws.cloudtrail-*`. Service Quotas management events are logged by default."
 57severity = "medium"
 58tags = [
 59    "Domain: Cloud",
 60    "Platform: AWS",
 61    "Data Source: AWS CloudTrail",
 62    "Service: AWS Service Quotas",
 63    "Rule Type: New Terms",
 64    "Tactic: Resource Development",
 65    "Resources: Investigation Guide",
 66]
 67timestamp_override = "event.ingested"
 68type = "new_terms"
 69
 70query = '''
 71data_stream.dataset: "aws.cloudtrail"
 72    and event.provider: "servicequotas.amazonaws.com"
 73    and event.action: "RequestServiceQuotaIncrease"
 74    and event.outcome: "success"
 75    and not user_agent.original: (*Terraform* or *Pulumi* or *Ansible* or "cloudformation.amazonaws.com")
 76'''
 77
 78
 79[[rule.threat]]
 80framework = "MITRE ATT&CK"
 81[[rule.threat.technique]]
 82id = "T1583"
 83name = "Acquire Infrastructure"
 84reference = "https://attack.mitre.org/techniques/T1583/"
 85
 86
 87[rule.threat.tactic]
 88id = "TA0042"
 89name = "Resource Development"
 90reference = "https://attack.mitre.org/tactics/TA0042/"
 91
 92[rule.investigation_fields]
 93field_names = [
 94    "@timestamp",
 95    "aws.cloudtrail.user_identity.arn",
 96    "aws.cloudtrail.user_identity.type",
 97    "aws.cloudtrail.user_identity.access_key_id",
 98    "user.name",
 99    "event.action",
100    "event.outcome",
101    "aws.cloudtrail.request_parameters",
102    "source.ip",
103    "cloud.region",
104    "cloud.account.id",
105]
106
107[rule.new_terms]
108field = "new_terms_fields"
109value = ["cloud.account.id", "user.name"]
110[[rule.new_terms.history_window_start]]
111field = "history_window_start"
112value = "now-7d"