Resource Created in Non-Standard Cloud Region
This rule detects HTTP POST requests to Amazon Web Services (AWS) endpoints that are associated with non-standard or less common cloud regions. Specifically, it looks for 'amazonaws.com' in the HTTP host and then checks the HTTP URI for region codes 'ap-east' (Asia Pacific - Hong Kong), 'me-south' (Middle East - Bahrain), or 'af-south' (Africa - Cape Town). The detection is triggered when a resource creation (indicated by HTTP POST) is attempted in one of these regions, which might be unusual for an organization primarily operating in other regions, potentially indicating unauthorized activity or misconfiguration.
Suricata
