T1535 — Unused/Unsupported Cloud Regions

Tactic: Stealth · Platforms: IaaS

Adversaries may create cloud instances in unused geographic service regions in order to evade detection. Access is usually obtained through compromising accounts used to manage cloud infrastructure. Cloud service providers often provide infrastructure throughout the world in order to improve…

Sigma detection rules (1)

T1535 Unused/Unsupported Cloud Regions

title: T1535 Unused/Unsupported Cloud Regions
id: e41a99f1-7937-4df1-a214-d4a1880a6a69
description: 'Detection of Adversary Use of Unused or Unsupported Cloud Regions (IaaS). (Retargeted to the cloudtrail AWS telemetry that actually captures this techniques behavior; see logsource below.) Tune using: UnusedRegionList, TimeWindow, AllowedServiceList, OutboundTrafficThreshold.'
references:
  - https://attack.mitre.org/techniques/T1535
author: Shahrukh Khan
date: 2026-02-06
license: MIT
tags:
  - attack.stealth
  - attack.t1535

logsource:
  category: cloudtrail
  product: aws

detection:
  selection:
    eventName:
      - 'RunInstances'
      - 'CreateBucket'
      - 'CreateFunction20150331'
  filter_expected_region:
    awsRegion:
      - 'us-east-1'
      - 'us-west-2'

  condition: selection and not filter_expected_region

falsepositives:
  - Legitimate multi-region deployments, disaster recovery failover tests, or a newly approved region rollout.

level: medium

Explore