Unused/Unsupported Cloud Regions

Adversaries may create cloud instances in unused geographic service regions in order to evade detection. Access is usually obtained through compromising accounts used to manage cloud infrastructure.

Cloud service providers often provide infrastructure throughout the world in order to improve performance, provide redundancy, and allow customers to meet compliance requirements. Oftentimes, a customer will only use a subset of the available regions and may not actively monitor other regions. If an adversary creates resources in an unused region, they may be able to operate undetected.

A variation on this behavior takes advantage of differences in functionality across cloud regions. An adversary could utilize regions which do not support advanced detection services in order to avoid detection of their activity.

An example of adversary use of unused AWS regions is to mine cryptocurrency through Resource Hijacking, which can cost organizations substantial amounts of money over time depending on the processing power used.[1]

ID: T1535
Sub-techniques:  No sub-techniques
Tactic: Defense Evasion
Platforms: IaaS
Permissions Required: User
Contributors: Netskope
Version: 1.1
Created: 04 September 2019
Last Modified: 22 April 2021

Mitigations

ID Mitigation Description
M1054 Software Configuration

Cloud service providers may allow customers to deactivate unused regions.[1]

Detection

ID Data Source Data Component Detects
DS0030 Instance Instance Creation

Monitor system logs to review instance activities occurring across all cloud environments and regions.

Instance Metadata

Monitor and consider configuring alerting to notify of activity in normally unused regions or if the number of instances active in a region goes above a certain threshold.

References