tfMITRE ATT&CK technique

Unused/Unsupported Cloud Regions T1535

Tactic: Stealth
Platform: IaaS
Version: 2.0
Created: 04 September 2019
Last modified: 12 May 2026
Contributor: Netskope

Adversaries may create cloud instances in unused geographic service regions in order to evade detection. Access is usually obtained through compromising accounts used to manage cloud infrastructure.

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groupsNone recorded

Threat groupsNone recorded · 29% of ATT&CK techniques have none either.

CampaignsNone recorded

CampaignsNone recorded · 54% of ATT&CK techniques have none either.

Tools & malwareNone recorded

Tools & malwareNone recorded · 29% of ATT&CK techniques have none either.

Detection rules64th pct

Detection rules64th percentile · 64% of ATT&CK techniques have this many detection rules written or fewer.

Offense vs defense T1535

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

How it got here

Range

Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.

Campaigns · 0Sigma rules (cumulative) · 0Splunk ESCU (cumulative) · 5

first rule: 2020 Q2

Unused/Unsupported Cloud Regions detection strategy DET0247

MITRE names one behaviour worth catching for this technique and breaks it into 1 analytic, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Detection of Adversary Use of Unused or Unsupported Cloud Regions (IaaS)

Enterprise

1 platform

AN0690 · IaaS

Detects creation of cloud instances, services, or resources in normally unused or unsupported regions, especially following initial account access or credential use from known regions. Correlates resource provisioning across regions with absence of historical usage and alerting from standard logging services (e.g., GuardDuty not enabled in that region).

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
User Account MetadataDC0013	CloudTrail:GetCallerIdentity	GetCallerIdentity
Cloud Storage CreationDC0024	AWS:CloudTrail	CreateBucket
Instance StartDC0080	AWS:CloudTrail	RunInstances
Network Connection CreationDC0082	AWS:VPCFlowLogs	High outbound traffic from new region resource

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
UnusedRegionList	List of regions historically unused by the organization (can vary per tenant/project)
TimeWindow	Time interval for correlating activity following account access
AllowedServiceList	Whitelist of services allowed in secondary/DR regions
OutboundTrafficThreshold	Volume threshold to flag suspicious outbound activity

Unused/Unsupported Cloud Regions detections T1535

5 rules are mapped to this technique. Parent techniques also include their sub-techniques’ rules. Click a slice or key entry to filter the table.

64th pctamong all ATT&CK techniques for number of rules

Product

Severity

Library

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs