2026 Critical Cloud Control Plane Detection: EC2 RunInstances in Unapproved/Dormant AWS Region
Detects 'ec2:RunInstances' API calls occurring in AWS regions that are not part of the organization's approved allow-list. This behavior can be indicative of malicious infrastructure staging, such as deploying assets for unauthorized cryptomining or establishing pivot points in regions that are infrequently monitored.
Cortex XDR
