Abnormally High Number Of Cloud Instances Launched

SPLUNK detection rule by David Dorsey, Splunk · Apache-2.0

The following analytic detects an abnormally high number of cloud instances launched within a 4-hour period. It leverages cloud infrastructure logs and applies a probability density model to identify outliers based on historical data. This activity is significant for a SOC because a sudden spike in instance creation could indicate unauthorized access or misuse of cloud resources. If confirmed malicious, this behavior could lead to resource exhaustion, increased costs, or provide attackers with additional compute resources to further their objectives.

name: Abnormally High Number Of Cloud Instances Launched
id: f2361e9f-3928-496c-a556-120cd4223a65
version: 10
creation_date: '2021-01-14'
modification_date: '2026-05-13'
author: David Dorsey, Splunk
status: removed
type: Anomaly
description: The following analytic detects an abnormally high number of cloud instances launched within a 4-hour period. It leverages cloud infrastructure logs and applies a probability density model to identify outliers based on historical data. This activity is significant for a SOC because a sudden spike in instance creation could indicate unauthorized access or misuse of cloud resources. If confirmed malicious, this behavior could lead to resource exhaustion, increased costs, or provide attackers with additional compute resources to further their objectives.
data_source:
    - AWS CloudTrail
search: |-
    | tstats count as instances_launched values(All_Changes.object_id) as object_id FROM datamodel=Change
      WHERE (
            All_Changes.action=created
        )
        AND All_Changes.status=success AND All_Changes.object_category=instance
      BY All_Changes.user _time span=1h
    | `drop_dm_object_name("All_Changes")`
    | eval HourOfDay=strftime(_time, "%H")
    | eval HourOfDay=floor(HourOfDay/4)*4
    | eval DayOfWeek=strftime(_time, "%w")
    | eval isWeekend=if(DayOfWeek >= 1 AND DayOfWeek <= 5, 0, 1)
    | join HourOfDay isWeekend [summary cloud_excessive_instances_created_v1]
    | where cardinality >=16
    | apply cloud_excessive_instances_created_v1 threshold=0.005
    | rename "IsOutlier(instances_launched)" as isOutlier
    | where isOutlier=1
    | eval expected_upper_threshold = mvindex(split(mvindex(BoundaryRanges, -1), ":"), 0)
    | eval distance_from_threshold = instances_launched - expected_upper_threshold
    | table _time, user, instances_launched, expected_upper_threshold, distance_from_threshold, object_id
    | `abnormally_high_number_of_cloud_instances_launched_filter`
how_to_implement: You must be ingesting your cloud infrastructure logs. You also must run the baseline search `Baseline Of Cloud Instances Launched` to create the probability density function.
known_false_positives: Many service accounts configured within an AWS infrastructure are known to exhibit this behavior. Please adjust the threshold values and filter out service accounts from the output. Always verify if this search alerted on a human user.
references: []
rba:
    message: At least $instances_launched$ instances launched by $user$
    risk_objects:
        - field: user
          type: user
          score: 20
    threat_objects: []
tags:
    analytic_story:
        - Cloud Cryptomining
        - Suspicious Cloud Instance Activities
    asset_type: Cloud Instance
    mitre_attack_id:
        - T1078.004
    product:
        - Splunk Enterprise
        - Splunk Enterprise Security
        - Splunk Cloud
    security_domain: threat
deprecation_info:
    reason: Detection is deprecated as these do not work with the latest Splunk AI Toolkit(5.7.0) and Python for Scientific Computing for Linux 64-bit(4.3.0).
    removed_in_version: 5.26.0
    replacement_content: []

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

6f5fc5e2-a829-433d-94f2-3da5b7253c1d

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion