AWS EnableRegion Command Monitoring

calendar Oct 22, 2025 · attack.persistence  ·
Share on: linkedin copy

Detects the use of the EnableRegion command in AWS CloudTrail logs. While AWS has 30+ regions, some of them are enabled by default, others must be explicitly enabled in each account separately. There may be situations where security monitoring does not cover some new AWS regions. Monitoring the EnableRegion command is important for identifying potential persistence mechanisms employed by adversaries, as enabling additional regions can facilitate continued access and operations within an AWS environment.

Sigma rule (View on GitHub)

 1title: AWS EnableRegion Command Monitoring
 2id: a5ffb6ea-c784-4e01-b30a-deb6e58ca2ab
 3status: experimental
 4description: |
 5    Detects the use of the EnableRegion command in AWS CloudTrail logs.
 6    While AWS has 30+ regions, some of them are enabled by default, others must be explicitly enabled in each account separately.
 7    There may be situations where security monitoring does not cover some new AWS regions.
 8    Monitoring the EnableRegion command is important for identifying potential persistence mechanisms employed by adversaries, as enabling additional regions can facilitate continued access and operations within an AWS environment.    
 9references:
10    - https://docs.aws.amazon.com/accounts/latest/reference/API_EnableRegion.html
11    - https://awscli.amazonaws.com/v2/documentation/api/2.14.0/reference/account/enable-region.html
12author: Ivan Saakov, Sergey Zelenskiy
13date: 2025-10-19
14tags:
15    - attack.persistence
16logsource:
17    product: aws
18    service: cloudtrail
19detection:
20    selection:
21        eventName: 'EnableRegion'
22        eventSource: 'account.amazonaws.com'
23    condition: selection
24falsepositives:
25    - Legitimate use of the EnableRegion command by authorized administrators.
26level: medium

References

Related rules

to-top