Anvilogic high experimental other

AWS Unused_Unsupported Regions [snowflake-awscloudtrail]

Adversaries may create cloud instances in unused geographic service regions in order to evade detection. Access is usually obtained through compromising accounts used to manage cloud infrastructure. This use case requires heavy filtering via the avl allowlist macro.

View Source

Detection Logic

select * from awscloudtrail where event_time > dateadd(hour, -2, sysdate()) and region is not null

Field Validations

Loading…

Comments (0)

Loading comments...