AWS EnableRegion Command Monitoring
Detects the use of the 'EnableRegion' command in AWS CloudTrail logs. This command allows an AWS account to enable additional regions. Monitoring this activity is crucial because adversaries might enable new, less-monitored regions to establish persistence, exfiltrate data, or conduct other malicious activities, potentially bypassing existing security controls that are not configured for these new regions.
Sigma
