New Cloud Instance Created in Suspicious Region

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•2

This rule detects attempts to create new cloud instances, specifically targeting AWS EC2, by monitoring HTTP traffic for requests to 'ec2.amazonaws.com' with the 'RunInstances' URI. The rule is designed to identify suspicious activity related to the provisioning of new virtual machines in a cloud environment, potentially indicating unauthorized resource creation or evasion tactics.