Cloud Instance Deleted to Remove Evidence

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•1

This rule detects HTTP traffic indicating an attempt to terminate an EC2 instance on AWS. Specifically, it looks for HTTP requests to 'ec2.amazonaws.com' with 'TerminateInstances' in the URI, which is a common API call used to delete cloud instances. This activity could be performed by an attacker to remove evidence of their presence or to disrupt services.