LoFP LoFP / T1583

T1583

TitleTags
cloud infrastructure teams requesting quota increases for planned capacity expansions, new region deployments, or scaling events will trigger this rule. validate the requested service and limit against your infrastructure roadmap before closing.
private hosted zones may be legitimately associated with vpcs by network or infrastructure administrators. verify whether the user identity, user agent, and source ip address align with expected administrative behavior. known and authorized associations may be exempted to reduce noise.
testing workflows that verify a sandbox email address and then clean it up may trigger this rule. confirm that the email identity verified and deleted corresponds to a planned test rather than a production or attacker-controlled domain.