Abnormally High Number Of Cloud Instances Destroyed

SPLUNK detection rule by David Dorsey, Splunk · Apache-2.0

The following analytic identifies an abnormally high number of cloud instances being destroyed within a 4-hour period. It leverages cloud infrastructure logs and applies a probability density model to detect outliers. This activity is significant for a SOC because a sudden spike in destroyed instances could indicate malicious activity, such as an insider threat or a compromised account attempting to disrupt services. If confirmed malicious, this could lead to significant operational disruptions, data loss, and potential financial impact due to the destruction of critical cloud resources.

name: Abnormally High Number Of Cloud Instances Destroyed
id: ef629fc9-1583-4590-b62a-f2247fbf7bbf
version: 9
creation_date: '2021-01-05'
modification_date: '2026-05-13'
author: David Dorsey, Splunk
status: removed
type: Anomaly
description: The following analytic identifies an abnormally high number of cloud instances being destroyed within a 4-hour period. It leverages cloud infrastructure logs and applies a probability density model to detect outliers. This activity is significant for a SOC because a sudden spike in destroyed instances could indicate malicious activity, such as an insider threat or a compromised account attempting to disrupt services. If confirmed malicious, this could lead to significant operational disruptions, data loss, and potential financial impact due to the destruction of critical cloud resources.
data_source:
    - AWS CloudTrail
search: |-
    | tstats count as instances_destroyed values(All_Changes.object_id) as object_id FROM datamodel=Change
      WHERE All_Changes.action=deleted
        AND
        All_Changes.status=success
        AND
        All_Changes.object_category=instance
      BY All_Changes.user _time span=1h
    | `drop_dm_object_name("All_Changes")`
    | eval HourOfDay=strftime(_time, "%H")
    | eval HourOfDay=floor(HourOfDay/4)*4
    | eval DayOfWeek=strftime(_time, "%w")
    | eval isWeekend=if(DayOfWeek >= 1 AND DayOfWeek <= 5, 0, 1)
    | join HourOfDay isWeekend [summary cloud_excessive_instances_destroyed_v1]
    | where cardinality >=16
    | apply cloud_excessive_instances_destroyed_v1 threshold=0.005
    | rename "IsOutlier(instances_destroyed)" as isOutlier
    | where isOutlier=1
    | eval expected_upper_threshold = mvindex(split(mvindex(BoundaryRanges, -1), ":"), 0)
    | eval distance_from_threshold = instances_destroyed - expected_upper_threshold
    | table _time, user, instances_destroyed, expected_upper_threshold, distance_from_threshold, object_id
    | `abnormally_high_number_of_cloud_instances_destroyed_filter`
how_to_implement: You must be ingesting your cloud infrastructure logs. You also must run the baseline search `Baseline Of Cloud Instances Destroyed` to create the probability density function.
known_false_positives: Many service accounts configured within a cloud infrastructure are known to exhibit this behavior. Please adjust the threshold values and filter out service accounts from the output. Always verify if this search alerted on a human user.
references: []
rba:
    message: At least $instances_destroyed$ instances destroyed by $user$
    risk_objects:
        - field: user
          type: user
          score: 20
    threat_objects: []
tags:
    analytic_story:
        - Suspicious Cloud Instance Activities
    asset_type: Cloud Instance
    mitre_attack_id:
        - T1078.004
    product:
        - Splunk Enterprise
        - Splunk Enterprise Security
        - Splunk Cloud
    security_domain: threat
deprecation_info:
    reason: Detection is deprecated as these do not work with the latest Splunk AI Toolkit(5.7.0) and Python for Scientific Computing for Linux 64-bit(4.3.0).
    removed_in_version: 5.26.0
    replacement_content: []

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

f87b1dfb-2849-4905-b185-b04799c1ccaf

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion