AWS Cryptomining

• EC2 Instance Started With Previously Unseen User :
  endpoint AWS Instance 2025-01-16 version:6
  This search looks for EC2 instances being created by users who have not created them before. This search is deprecated and have been translated to use the latest Change Datamodel.


• Abnormally High AWS Instances Launched by User :
  network AWS Instance 2024-11-14 version:5
  This search looks for AWS CloudTrail events where a user successfully launches an abnormally high number of instances. This search is deprecated and have been translated to use the latest Change Datamodel


• EC2 Instance Started With Previously Unseen AMI :
  endpoint AWS Instance 2025-01-16 version:5
  This search looks for EC2 instances being created with previously unseen AMIs. This search is deprecated and have been translated to use the latest Change Datamodel.


• EC2 Instance Started With Previously Unseen Instance Type :
  endpoint AWS Instance 2025-01-16 version:6
  This search looks for EC2 instances being created with previously unseen instance types. This search is deprecated and have been translated to use the latest Change Datamodel.


• EC2 Instance Started In Previously Unseen Region :
  network AWS Instance 2024-11-14 version:4
  This search looks for AWS CloudTrail events where an instance is started in a particular region in the last one hour and then compares it to a lookup file of previously seen regions where an instance was started


• Abnormally High AWS Instances Launched by User - MLTK :
  network AWS Instance 2024-11-14 version:5
  This search looks for AWS CloudTrail events where a user successfully launches an abnormally high number of instances. This search is deprecated and have been translated to use the latest Change Datamodel.