AWS CloudTrail: EnableRegion API command monitoring for account region enablement

Alerts on AWS account region enablement via CloudTrail when the EnableRegion API call occurs.

FreeUnreviewedSigmamediumv1

aws-cloudtrail-enableregion-api-command-monitoring-for-account-region-enablement-a5ffb6ea

title: "AWS CloudTrail: EnableRegion API command monitoring for account region enablement"
id: 2b833498-d7cc-4b48-9fae-115a2173aa23
status: experimental
description: This rule flags AWS CloudTrail events where the account.amazonaws.com API method "EnableRegion" is called. Enabling additional AWS regions can expand where resources can be created and operated, which may help adversaries maintain access or persist in an environment. The detection relies on CloudTrail telemetry capturing the eventName "EnableRegion" and the eventSource "account.amazonaws.com".
references:
  - https://docs.aws.amazon.com/accounts/latest/reference/API_EnableRegion.html
  - https://awscli.amazonaws.com/v2/documentation/api/2.14.0/reference/account/enable-region.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/aws/cloudtrail/aws_cloudtrail_region_enabled.yml
author: Ivan Saakov, Sergey Zelenskiy, Huntrule Team
date: 2025-10-19
tags:
  - attack.persistence
logsource:
  product: aws
  service: cloudtrail
detection:
  selection:
    eventName: EnableRegion
    eventSource: account.amazonaws.com
  condition: selection
falsepositives:
  - Legitimate use of the EnableRegion command by authorized administrators.
level: medium
license: DRL-1.1
related:
  - id: a5ffb6ea-c784-4e01-b30a-deb6e58ca2ab
    type: derived

What it detects

This rule flags AWS CloudTrail events where the account.amazonaws.com API method "EnableRegion" is called. Enabling additional AWS regions can expand where resources can be created and operated, which may help adversaries maintain access or persist in an environment. The detection relies on CloudTrail telemetry capturing the eventName "EnableRegion" and the eventSource "account.amazonaws.com".

Known false positives

Legitimate use of the EnableRegion command by authorized administrators.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.