Data Source: AWS Service Quotas | Detection.FYI

AWS Service Quotas Multi-Region GetServiceQuota Requests

Jan 22, 2025 · Domain: Cloud Data Source: AWS Data Source: Amazon Web Services Data Source: AWS Service Quotas Use Case: Threat Detection Tactic: Discovery Resources: Investigation Guide ·
Share on:

Identifies when a single AWS resource is making GetServiceQuota API calls for the EC2 service quota L-1216C47A in more than 10 regions within a 30-second window. Quota code L-1216C47A represents on-demand instances which are used by adversaries to deploy malware and mine cryptocurrency. This could indicate a potential threat actor attempting to discover the AWS infrastructure across multiple regions using compromised credentials or a compromised instance.

Read More