Suspicious AWS EC2 Activities

• Abnormally High AWS Instances Terminated by User - MLTK :
  network AWS Instance 2024-11-14 version:5
  This search looks for AWS CloudTrail events where a user successfully terminates an abnormally high number of instances. This search is deprecated and have been translated to use the latest Change Datamodel.


• EC2 Instance Started With Previously Unseen User :
  endpoint AWS Instance 2025-01-16 version:6
  This search looks for EC2 instances being created by users who have not created them before. This search is deprecated and have been translated to use the latest Change Datamodel.


• Abnormally High AWS Instances Launched by User :
  network AWS Instance 2024-11-14 version:5
  This search looks for AWS CloudTrail events where a user successfully launches an abnormally high number of instances. This search is deprecated and have been translated to use the latest Change Datamodel


• Abnormally High AWS Instances Terminated by User :
  network AWS Instance 2024-11-14 version:5
  This search looks for AWS CloudTrail events where an abnormally high number of instances were successfully terminated by a user in a 10-minute window. This search is deprecated and have been translated to use the latest Change Datamodel.


• EC2 Instance Started In Previously Unseen Region :
  network AWS Instance 2024-11-14 version:4
  This search looks for AWS CloudTrail events where an instance is started in a particular region in the last one hour and then compares it to a lookup file of previously seen regions where an instance was started


• Abnormally High AWS Instances Launched by User - MLTK :
  network AWS Instance 2024-11-14 version:5
  This search looks for AWS CloudTrail events where a user successfully launches an abnormally high number of instances. This search is deprecated and have been translated to use the latest Change Datamodel.