Cloud Service Hijacked for Cryptomining Workload

Darshan Thummar@Mighty

•updated Jun 12, 2026•0•0•2

This rule detects HTTP traffic indicating a potential cloud service compromise for cryptomining. Specifically, it looks for HTTP requests to 'ec2.amazonaws.com' with the URI containing 'RunInstances' and the client body containing 'p3' (case-insensitive). This combination suggests an attempt to provision EC2 instances, possibly for cryptomining, using a compromised AWS account.