Attempt to create Xlarge EC2 instances in multiple AWS regions

cloudtrail

Classification:

attack

Tactic:

TA0005-defense-evasion

Technique:

T1535-unused-or-unsupported-cloud-regions

이 페이지는 아직 한국어로 제공되지 않으며 번역 작업 중입니다. 번역에 관한 질문이나 의견이 있으시면 언제든지 저희에게 연락해 주십시오.

Goal

Detect when there is an attempt to create Xlarge EC2 instances in multiple AWS regions.

Strategy

Monitor CloudTrail and detect when an attempt to create Xlarge EC2 instances in multiple AWS regions occurs. An attacker may use Xlarge EC2 instances as a means of creating easily scalable resources to mine cryptocurrency. To avoid detection and resource service quotas, the attacker may try to create these resources in multiple regions.

Triage and response

  1. Determine if {{@userIdentity.arn}} should have carried out this operation.
  2. If the API calls were not made by the user:
  • Rotate user credentials.
  • Remove the newly created instances {{@@responseElements.instancesSet.items.instanceId}} if the API call was successful.
  • Remove any associated EC2 security groups or key pairs.
  • Determine what other API calls were made by the user.
  • Begin your organization’s incident response process and investigate.