Cloud Compute Infrastructure Modified for Evasion

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•3

This rule detects HTTP POST requests to cloud compute infrastructure management endpoints, specifically Amazon EC2, Google Cloud Compute, and Azure Management. The rule is triggered if 20 such requests are observed from a single source IP within 60 seconds, indicating potential automated activity to modify cloud infrastructure for evasion purposes.