{"source_checked_on":"2026-10-19","schema_version":1,"key":"enterprise/T1535","id":"T1535","name":"Unused/Unsupported Cloud Regions","domain":"enterprise","reviewed_on":"2026-09-28","source_url":"https://attack.mitre.org/techniques/T1535","source_file":{"file":"enterprise.json","url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/20664a889568dce884a1dac0ec7b12ae3a199f51/enterprise-attack/enterprise-attack-20.0.json","sha256":"81113ba98afa2928f3dcff62022539f7ce30c315c32e14422f11ff95ce534352","bytes":55271014},"source_object_sha256":"d2cb0915c96cf6e1ca13249d9245b445a75df16798deea098b7d482560f3e49b","description":"Adversaries may create cloud instances in unused geographic service regions in order to evade detection. Access is usually obtained through compromising accounts used to manage cloud infrastructure.\n\nCloud service providers often provide infrastructure throughout the world in order to improve performance, provide redundancy, and allow customers to meet compliance requirements. Oftentimes, a customer will only use a subset of the available regions and may not actively monitor other regions. If an adversary creates resources in an unused region, they may be able to operate undetected.\n\nA variation on this behavior takes advantage of differences in functionality across cloud regions. An adversary could utilize regions which do not support advanced detection services in order to avoid detection of their activity.\n\nAn example of adversary use of unused AWS regions is to mine cryptocurrency through [Resource Hijacking](https://attack.mitre.org/techniques/T1496), which can cost organizations substantial amounts of money over time depending on the processing power used.(Citation: CloudSploit - Unused AWS Regions)","references":[{"source_name":"mitre-attack","url":"https://attack.mitre.org/techniques/T1535","external_id":"T1535"},{"source_name":"CloudSploit - Unused AWS Regions","description":"CloudSploit. (2019, June 8). The Danger of Unused AWS Regions. Retrieved October 8, 2019.","url":"https://medium.com/cloudsploit/the-danger-of-unused-aws-regions-af0bf1b878fc"}],"platforms":["IaaS"],"environments":["cloud"],"visibility":"source_mapped","visibility_note":null,"parent":null,"children":[],"telemetry":[{"id":"DC0024","name":"Cloud Storage Creation","page":"telemetry/DC0024/","kind":"attack_component","category":"Cloud storage","description":"Creation of a cloud storage resource such as a bucket or container.","collection_focus":"Collect bucket/container creation APIs and resulting resource state. An object upload is not equivalent to provisioning the storage resource.","providers":[{"name":"AWS CloudTrail for S3","scope":"Bucket control-plane events and explicitly selected object data events.","source_id":"data_events"},{"name":"Google Cloud Audit Logs","scope":"Cloud Storage access requires the relevant audit category and permissions.","source_id":"gcp"},{"name":"Azure storage resource logs","scope":"Use resource-specific data-plane diagnostics; Activity Log alone does not describe blob reads.","source_id":"azure_storage"}],"configuration":["Choose only the lab buckets/containers and prefixes. Enable read/write data-event collection when object access is needed; management events alone are insufficient.","Keep administrative changes separately from object reads/writes. Set a cost budget and retention limit before enabling high-volume data logging.","Preserve object version/key, requesting identity, action, source address, result and request ID. Verify the collector actually receives one benign read and one benign write."],"configuration_example":null,"required_fields":["action","bucket","region","actor"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0024","collector":"illustrative-lab-collector","observation":{"action":"create_bucket","bucket":"lab-bucket","region":"lab-region","actor":"lab-admin"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Storage metadata, listing, object access and bucket administration are different operations. Do not equate a successful request with proven exfiltration or complete content visibility.","sources":[{"id":"data_events","title":"AWS CloudTrail data-event selectors","url":"https://docs.aws.amazon.com/awscloudtrail/latest/userguide/logging-data-events-with-cloudtrail.html"},{"id":"cloudtrail","title":"AWS CloudTrail event categories","url":"https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-events.html"},{"id":"gcp","title":"Google Cloud Audit Logs","url":"https://docs.cloud.google.com/logging/docs/audit"},{"id":"azure_storage","title":"Azure Blob Storage resource logging","url":"https://learn.microsoft.com/en-us/azure/storage/blobs/monitor-blob-storage"}],"association":"attack_component","anomaly_design":"Per principal and bucket/container: unusual object-read counts, transferred volume, new access pairs and bulk permission/deletion activity. Model backups, migrations and lifecycle policies separately."},{"id":"DC0080","name":"Instance Start","page":"telemetry/DC0080/","kind":"attack_component","category":"Cloud control plane","description":"A request to start a stopped compute instance and its resulting state.","collection_focus":"Collect start APIs and instance-state transitions with request IDs; distinguish accepted from completed.","providers":[{"name":"AWS CloudTrail","scope":"Management-plane API activity; supported resource/data events require separate selectors.","source_id":"cloudtrail"},{"name":"Azure Monitor Activity Log","scope":"Azure resource control-plane operations; resource data-plane logs are separate.","source_id":"azure"},{"name":"Google Cloud Audit Logs","scope":"Admin Activity and other categories; configure Data Access where required.","source_id":"gcp"}],"configuration":["In the isolated account/project/subscription, route administrative audit logs to a protected destination with retention and access controls.","Select the relevant service, regions and read/write operations. Confirm whether the API below is a management or data event in the provider documentation.","Preserve actor/session, resource, request ID, service, operation, region and error details. Check delivery latency and avoid logging credentials or sensitive request bodies."],"configuration_example":null,"required_fields":["instance_id","action","state_before","state_after"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0080","collector":"illustrative-lab-collector","observation":{"instance_id":"vm-lab-1","action":"start","state_before":"stopped","state_after":"pending"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"AWS, Azure and Google expose different APIs and event schemas. An accepted API request does not prove the final resource state; join asynchronous outcomes and inventory.","sources":[{"id":"cloudtrail","title":"AWS CloudTrail event categories","url":"https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-events.html"},{"id":"ec2","title":"AWS EC2 API logging with CloudTrail","url":"https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/monitor-with-cloudtrail.html"},{"id":"azure","title":"Azure Monitor Activity Log","url":"https://learn.microsoft.com/en-us/azure/azure-monitor/fundamentals/activity-log"},{"id":"gcp","title":"Google Cloud Audit Logs","url":"https://docs.cloud.google.com/logging/docs/audit"}],"association":"attack_component","anomaly_design":"Per account, role, region and API: rare actions, new role-resource relationships, enumeration bursts and configuration changes. Separate deployment automation and organization-level administrative activity."},{"id":"DC0082","name":"Network Connection Creation","page":"telemetry/DC0082/","kind":"attack_component","category":"Endpoint activity","description":"Creation of an endpoint network connection linked to a process.","collection_focus":"Enable scoped Sysmon NetworkConnect (3), disabled by default, or a platform-equivalent process-aware network sensor.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"},{"name":"Linux Audit","scope":"Linux alternative for supported system-call and file events; different semantics and fields.","source_id":"linux"},{"name":"Apple Endpoint Security clients","scope":"macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.","source_id":"apple"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms."],"configuration_example":null,"required_fields":["process_guid","destination_ip","destination_port","protocol","initiated"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0082","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","destination_ip":"198.51.100.20","destination_port":443,"protocol":"tcp","initiated":true}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"},{"id":"apple","title":"Apple Endpoint Security framework for macOS","url":"https://developer.apple.com/documentation/endpointsecurity"},{"id":"process_audit","title":"Microsoft process creation event 4688","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4688"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."},{"id":"DC0013","name":"User Account Metadata","page":"telemetry/DC0013/","kind":"attack_component","category":"Host state and inventory","description":"Account inventory and attributes at a point in time.","collection_focus":"Export an authorized directory/account inventory with stable IDs, roles, enabled state and collection time; compare snapshots without exposing credentials.","providers":[{"name":"osquery","scope":"Scheduled host-state queries; supported tables and privileges vary by OS. Select a table that actually exposes the required object.","source_id":"osquery"},{"name":"Linux Audit plus inventory snapshots","scope":"Events explain changes; snapshots describe state at collection time.","source_id":"linux"}],"configuration":["Define the inventory query, allowed host set, interval and least-privileged reader. Store a stable asset ID, observation time and collector version.","Keep successive snapshots and calculate additions, removals and changed attributes. Pair state changes with audit events when available.","Export collector health and missed-poll counts so a missing snapshot is not misclassified as a missing asset."],"configuration_example":null,"required_fields":["account_id","enabled","roles","inventory_time"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0013","collector":"illustrative-lab-collector","observation":{"account_id":"user-lab-1","enabled":true,"roles":["lab-reader"],"inventory_time":"2026-09-27T12:00:00Z"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Snapshots miss short-lived objects and do not identify who caused a change. A generic inventory agent is not guaranteed to expose firmware or kernel-level details.","sources":[{"id":"osquery","title":"osquery scheduled configuration","url":"https://github.com/osquery/osquery/blob/master/docs/wiki/deployment/configuration.md"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"}],"association":"attack_component","anomaly_design":"Compare authorized state snapshots: first-seen drivers/services/modules, unexpected configuration drift and integrity changes. Record collection cadence; absence in a sample is not evidence of deletion."}],"detection":{"key":"enterprise/T1535","id":"T1535","name":"Unused/Unsupported Cloud Regions","domain":"enterprise","platforms":["IaaS"],"environments":["cloud"],"source_url":"https://attack.mitre.org/techniques/T1535","technique_page":"techniques/enterprise/T1535/","page":"detections/enterprise/T1535/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"sigma_rules":[],"atlas_basic":[],"atlas_anomaly":[],"anomaly_types":[],"strategies":[{"id":"DET0247","name":"Detection of Adversary Use of Unused or Unsupported Cloud Regions (IaaS)","url":"https://attack.mitre.org/detectionstrategies/DET0247","stix_id":"x-mitre-detection-strategy--ec3e5f66-a2b8-48ae-9adf-eb4f5014ba70","relationship_id":"relationship--17601081-e7e7-4d81-9bb1-d7101c7619ed","description":"","analytics":[{"id":"AN0690","name":"Analytic 0690","guidance":"Detects creation of cloud instances, services, or resources in normally unused or unsupported regions, especially following initial account access or credential use from known regions. Correlates resource provisioning across regions with absence of historical usage and alerting from standard logging services (e.g., GuardDuty not enabled in that region).","url":"https://attack.mitre.org/detectionstrategies/DET0247#AN0690","platforms":["IaaS"],"tuning":[{"field":"UnusedRegionList","description":"List of regions historically unused by the organization (can vary per tenant/project)"},{"field":"TimeWindow","description":"Time interval for correlating activity following account access"},{"field":"AllowedServiceList","description":"Whitelist of services allowed in secondary/DR regions"},{"field":"OutboundTrafficThreshold","description":"Volume threshold to flag suspicious outbound activity"}],"log_sources":[{"component_id":"DC0080","component":"Instance Start","name":"AWS:CloudTrail","channel":"RunInstances","platforms":["IaaS"],"analytic_id":"AN0690","source_url":"https://attack.mitre.org/detectionstrategies/DET0247#AN0690","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0080/"},{"component_id":"DC0024","component":"Cloud Storage Creation","name":"AWS:CloudTrail","channel":"CreateBucket","platforms":["IaaS"],"analytic_id":"AN0690","source_url":"https://attack.mitre.org/detectionstrategies/DET0247#AN0690","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0024/"},{"component_id":"DC0013","component":"User Account Metadata","name":"CloudTrail:GetCallerIdentity","channel":"GetCallerIdentity","platforms":["IaaS"],"analytic_id":"AN0690","source_url":"https://attack.mitre.org/detectionstrategies/DET0247#AN0690","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0013/"},{"component_id":"DC0082","component":"Network Connection Creation","name":"AWS:VPCFlowLogs","channel":"High outbound traffic from new region resource","platforms":["IaaS"],"analytic_id":"AN0690","source_url":"https://attack.mitre.org/detectionstrategies/DET0247#AN0690","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0082/"}]}]}],"telemetry_references":[{"id":"DC0024","name":"Cloud Storage Creation","tag":"Cloud Storage Creation","page":"telemetry/DC0024/","kind":"attack_component"},{"id":"DC0080","name":"Instance Start","tag":"Instance Start","page":"telemetry/DC0080/","kind":"attack_component"},{"id":"DC0082","name":"Network Connection Creation","tag":"Network Connection Creation","page":"telemetry/DC0082/","kind":"attack_component"},{"id":"DC0013","name":"User Account Metadata","tag":"User Account Metadata","page":"telemetry/DC0013/","kind":"attack_component"}],"visibility":"source_mapped","visibility_note":null,"tool_references":[],"related_parent":null,"article_url":"https://1200km.com/articles/read/2026/2026-04-20-malicious-activity-as-a-statistical-signal-a-detection-engineering-analysis-of-anomaly-bas-90df8b6dea12/","validation":{"source_join":"exact_ids","sigma_yaml":"parsed","backend_compilation":"not_run","live_telemetry":"not_run","detection_execution":"not_run"}},"tools":[],"software":[],"actors":[],"mitigations":[{"id":"M1054","name":"Software Configuration","url":"https://attack.mitre.org/mitigations/M1054","kind":"course-of-action","description":"Cloud service providers may allow customers to deactivate unused regions.(Citation: CloudSploit - Unused AWS Regions)","relationship_id":"relationship--70add783-c72c-4048-ba94-5e1e79c2d679","references":[{"source_name":"CloudSploit - Unused AWS Regions","description":"CloudSploit. (2019, June 8). The Danger of Unused AWS Regions. Retrieved October 8, 2019.","url":"https://medium.com/cloudsploit/the-danger-of-unused-aws-regions-af0bf1b878fc"}]}],"candidates":[],"simulation":{"atomic_status":"no_atomic_candidate","lab_execution":"not_run","browser_attack_runner":false,"prerequisites":"Use disposable lab hosts and test accounts, explicit target allowlists, a clean snapshot, bounded egress and a restore plan. Review every candidate and dependency before any execution.","scenario":null},"validation":{"source_identity":"checked_against_pinned_source","relationship_join":"exact_ids_no_inheritance","page_contract":"automated_checks_required","sensor_capture":"not_run","detection_backend":"not_run","adversary_simulation":"not_run","independent_incident_fact_check":"not_performed"},"technique_links":{"T1496":"/ttp-simulation/techniques/enterprise/T1496/","T1535":"/ttp-simulation/techniques/enterprise/T1535/"},"synthetic":{"schema":"1200km.ttp.collection-fixture.v1","synthetic":true,"technique_key":"enterprise/T1535","purpose":"Collection/parser contract exercise, NOT a positive example or detection of this TTP.","events":[{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0024","collector":"illustrative-lab-collector","observation":{"action":"create_bucket","bucket":"lab-bucket","region":"lab-region","actor":"lab-admin"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0080","collector":"illustrative-lab-collector","observation":{"instance_id":"vm-lab-1","action":"start","state_before":"stopped","state_after":"pending"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0082","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","destination_ip":"198.51.100.20","destination_port":443,"protocol":"tcp","initiated":true}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0013","collector":"illustrative-lab-collector","observation":{"account_id":"user-lab-1","enabled":true,"roles":["lab-reader"],"inventory_time":"2026-09-27T12:00:00Z"}}]}}