AWS Service Quota Increase Requested by Rare Identity

Last updated a month ago on 2026-09-18

Created 2 months ago on 2026-08-24

About

Detects the first time an AWS identity requests a service quota increase via the AWS Service Quotas API within a 7-day history window. Service quota increases are submitted to AWS Support and, when approved, raise the limits on EC2 instances, Lambda concurrency, VPC resources, and other services. An adversary who obtains AWS credentials may request quota increases as infrastructure preparation for large-scale cryptomining, DDoS amplification, phishing campaigns, or data exfiltration operations that require compute or network resources beyond the account's current limits.

Tags

Domain: CloudData Source: AWSData Source: Amazon Web ServicesPlatform: AWSData Source: AWS CloudTrailService: AWS Service QuotasRule Type: New TermsTactic: Resource DevelopmentLanguage: kuery

Severity

medium

Risk Score

MITRE ATT&CK™

Resource Development (TA0042)(external, opens in a new tab or window)

↳ Acquire Infrastructure (T1583)(external, opens in a new tab or window)

False Positive Examples

Cloud infrastructure teams requesting quota increases for planned capacity expansions, new region deployments, or scaling events will trigger this rule. Validate the requested service and limit against your infrastructure roadmap before closing.

License

Elastic License v2(external, opens in a new tab or window)

Definition

Rule Type: New Terms Rule
Integration Pack: Prebuilt Security Detection Rules
Index Patterns: logs-aws.cloudtrail-*
Related Integrations: aws(external, opens in a new tab or window)
Query

✄𐘗text code block:
✄𐘗data_stream.dataset: "aws.cloudtrail"
    and event.provider: "servicequotas.amazonaws.com"
    and event.action: "RequestServiceQuotaIncrease"
    and event.outcome: "success"
    and not user_agent.original: (*Terraform* or *Pulumi* or *Ansible* or "cloudformation.amazonaws.com")

Install detection rules in Elastic Security

Detect AWS Service Quota Increase Requested by Rare Identity in the Elastic Security detection engine by installing this rule into your Elastic Stack.

To setup this rule, check out the installation guide for Prebuilt Security Detection Rules(external, opens in a new tab or window).