AWS EC2 GPU / Large Instance Launch Detection

Lacey Cochrane@NullVectorX

•updated Mar 16, 2026•2•0•82

This rule detects the launch of Amazon EC2 instances with GPU-enabled or very large instance types. Adversaries may launch such instances for resource-intensive tasks like cryptocurrency mining or other compute-heavy operations, which can lead to unexpected cloud costs and resource hijacking.