LoFP / cloud infrastructure teams requesting quota increases for planned capacity expansions, new region deployments, or scaling events will trigger this rule. validate the requested service and limit against your infrastructure roadmap before closing.

Techniques

• T1583

Sample rules

AWS Service Quota Increase Requested by Rare Identity

• source: elastic
• technicques:
  • T1583

Description

Detects the first time an AWS identity requests a service quota increase via the AWS Service Quotas API within a 7-day history window. Service quota increases are submitted to AWS Support and, when approved, raise the limits on EC2 instances, Lambda concurrency, VPC resources, and other services. An adversary who obtains AWS credentials may request quota increases as infrastructure preparation for large-scale cryptomining, DDoS amplification, phishing campaigns, or data exfiltration operations that require compute or network resources beyond the account’s current limits.

Detection logic

data_stream.dataset: "aws.cloudtrail"
    and event.provider: "servicequotas.amazonaws.com"
    and event.action: "RequestServiceQuotaIncrease"
    and event.outcome: "success"
    and not user_agent.original: (*Terraform* or *Pulumi* or *Ansible* or "cloudformation.amazonaws.com")