tfMITRE ATT&CK technique

Unused/Unsupported Cloud Regions T1535

Tactic: Stealth
Platform: IaaS
Version: 2.0
Created: 04 September 2019
Last modified: 12 May 2026
Contributor: Netskope

Adversaries may create cloud instances in unused geographic service regions in order to evade detection. Access is usually obtained through compromising accounts used to manage cloud infrastructure.

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groupsNone recorded

Threat groupsNone recorded · 29% of ATT&CK techniques have none either.

CampaignsNone recorded

CampaignsNone recorded · 54% of ATT&CK techniques have none either.

Tools & malwareNone recorded

Tools & malwareNone recorded · 29% of ATT&CK techniques have none either.

Detection rules64th pct

Detection rules64th percentile · 60% of ATT&CK techniques have fewer detection rules written.

Offense vs defense T1535

Compare defenses against adversary use. Eight counts, ranking this technique against the entire ATT&CK Enterprise matrix. Attack sits left, defense right.

Range

Technique Campaign use over its cumulative rule count.

Campaigns · 0Sigma rules (cumulative) · 0Splunk ESCU (cumulative) · 5

Data component	Name	Channel
User Account MetadataDC0013	CloudTrail:GetCallerIdentity	GetCallerIdentity
Cloud Storage CreationDC0024	AWS:CloudTrail	CreateBucket
Instance StartDC0080	AWS:CloudTrail	RunInstances
Network Connection CreationDC0082	AWS:VPCFlowLogs	High outbound traffic from new region resource

Data component

Name

Channel

User Account MetadataDC0013

CloudTrail:GetCallerIdentity

GetCallerIdentity

Cloud Storage CreationDC0024

AWS:CloudTrail

CreateBucket

Instance StartDC0080

AWS:CloudTrail

RunInstances

Network Connection CreationDC0082

AWS:VPCFlowLogs

High outbound traffic from new region resource

Field	What you tune
UnusedRegionList	List of regions historically unused by the organization (can vary per tenant/project)
TimeWindow	Time interval for correlating activity following account access
AllowedServiceList	Whitelist of services allowed in secondary/DR regions
OutboundTrafficThreshold	Volume threshold to flag suspicious outbound activity

Field

What you tune

UnusedRegionList

List of regions historically unused by the organization (can vary per tenant/project)

TimeWindow

Time interval for correlating activity following account access

AllowedServiceList

Whitelist of services allowed in secondary/DR regions

OutboundTrafficThreshold

Volume threshold to flag suspicious outbound activity

Offense vs defense T1535

Compare defenses against adversary use. Eight counts, ranking this technique against the entire ATT&CK Enterprise matrix. Attack sits left, defense right.

Range

Technique Campaign use over its cumulative rule count.

Campaigns · 0Sigma rules (cumulative) · 0Splunk ESCU (cumulative) · 5

Data component	Name	Channel
User Account MetadataDC0013	CloudTrail:GetCallerIdentity	GetCallerIdentity
Cloud Storage CreationDC0024	AWS:CloudTrail	CreateBucket
Instance StartDC0080	AWS:CloudTrail	RunInstances
Network Connection CreationDC0082	AWS:VPCFlowLogs	High outbound traffic from new region resource

Data component

Name

Channel

User Account MetadataDC0013

CloudTrail:GetCallerIdentity

GetCallerIdentity

Cloud Storage CreationDC0024

AWS:CloudTrail

CreateBucket

Instance StartDC0080

AWS:CloudTrail

RunInstances

Network Connection CreationDC0082

AWS:VPCFlowLogs

High outbound traffic from new region resource

Field	What you tune
UnusedRegionList	List of regions historically unused by the organization (can vary per tenant/project)
TimeWindow	Time interval for correlating activity following account access
AllowedServiceList	Whitelist of services allowed in secondary/DR regions
OutboundTrafficThreshold	Volume threshold to flag suspicious outbound activity

Field

What you tune

UnusedRegionList

List of regions historically unused by the organization (can vary per tenant/project)

TimeWindow

Time interval for correlating activity following account access

AllowedServiceList

Whitelist of services allowed in secondary/DR regions

OutboundTrafficThreshold

Volume threshold to flag suspicious outbound activity

Select	Description	Category	Status	Event	OS	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs
Splunk	The following analytic detects an AWS account successfully authenticating from multiple unique IP addresses within a 5-minute window. (...)	Anomaly	stable	authentication	-	AWS CloudTrail · AWS	Resource Development Compromise Accounts Stealth Unused/Unsupported Cloud Regions	-	medium	Bhavin Patel, Splunk	2023-01-19	2026-05-13	395e50e1-2b87-4fa3-8632-0dfbdcbcd2cb
Splunk	The following analytic detects the creation of a cloud compute instance in a region that has not been previously used within the last hour. (...)	Anomaly	stable	configuration_change	-	AWS CloudTrail · AWS	Stealth Unused/Unsupported Cloud Regions	-	medium	David Dorsey, Splunk	2020-11-30	2026-09-22	fa4089e2-50e3-40f7-8469-d2cc1564ca59	-
Splunk	The following analytic identifies AWS console login events by users from a new city within the last hour. (...)	Hunting	stable	authentication	-	AWS CloudTrail · AWS	Resource Development Compromise Accounts Cloud Accounts Stealth Unused/Unsupported Cloud Regions	-	medium	Bhavin Patel, Eric McGinnis Splunk	2020-04-29	2026-05-13	121b0b11-f8ac-4ed6-a132-3800ca4fc07a	-
Splunk	The following analytic identifies AWS console login events by users from a new country. (...)	Hunting	stable	authentication	-	AWS CloudTrail · AWS	Resource Development Compromise Accounts Cloud Accounts Stealth Unused/Unsupported Cloud Regions	-	medium	Bhavin Patel, Eric McGinnis Splunk	2020-04-29	2026-05-13	67bd3def-c41c-4bf6-837b-ae196b4257c6	-
Splunk	The following analytic identifies AWS console login attempts by users from a new region. (...)	Hunting	stable	authentication	-	AWS CloudTrail · AWS	Resource Development Compromise Accounts Cloud Accounts Stealth Unused/Unsupported Cloud Regions	-	medium	Bhavin Patel, Eric McGinnis Splunk	2020-04-29	2026-05-13	9f31aa8e-e37c-46bc-bce1-8b3be646d026	-

Title

Description

Unused/Unsupported Cloud Regions T1535

Unused/Unsupported Cloud Regions T1535

Offense vs defense T1535

Unused/Unsupported Cloud Regions detection strategy DET0247

Detection of Adversary Use of Unused or Unsupported Cloud Regions (IaaS)

Log sources

Tunable fields

Offense vs defense T1535

Unused/Unsupported Cloud Regions detection strategy DET0247

Detection of Adversary Use of Unused or Unsupported Cloud Regions (IaaS)

Log sources

Tunable fields

Unused/Unsupported Cloud Regions detections T1535

Unused/Unsupported Cloud Regions detections T1535