2026 Critical Cloud Control Plane Detection: Mass Compute Instance Creation in Unused Region Indicating Resource Hijacking
Detects the mass creation of high-performance compute instances (GPU or high-memory variants) in an AWS environment. By filtering out legitimate service-linked roles associated with auto-scaling, the rule isolates potentially unauthorized manual provisioning, often indicative of cryptojacking or resource hijacking.
Sigma
