AWS CloudTrail Account EnableRegion Command Usage
Alerts on AWS account region enablement via CloudTrail when the EnableRegion API call occurs.
FreeReviewedSigma · Medium · v5
- Product
- aws
- Service
- cloudtrail
- Author
- Ivan Saakov, Sergey Zelenskiy (SigmaHQ), DRL 1.1
- Published
- 2025-10-19
- Updated
- 2026-07-31
What it detects
This rule flags CloudTrail events where the AWS API call EnableRegion is executed against account.amazonaws.com. Enabling additional AWS regions can expand the environment available for operations, so attackers may use this to maintain or extend access across regions. The detection relies on CloudTrail eventName and eventSource telemetry identifying the specific API action.
Reporting behind it
- docs.aws.amazon.comhttps://docs.aws.amazon.com/accounts/latest/reference/API_EnableRegion.html
- awscli.amazonaws.comhttps://awscli.amazonaws.com/v2/documentation/api/2.14.0/reference/account/enable-region.html
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/cloud/aws/cloudtrail/aws_cloudtrail_region_enabled.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
aws-cloudtrail-enableregion-api-command-monitoring-for-account-region-enablement-a5ffb6ea
title: AWS CloudTrail Account EnableRegion Command Usage
id: 2b833498-d7cc-4b48-9fae-115a2173aa23
status: experimental
description: This rule flags CloudTrail events where the AWS API call EnableRegion is executed against account.amazonaws.com. Enabling additional AWS regions can expand the environment available for operations, so attackers may use this to maintain or extend access across regions. The detection relies on CloudTrail eventName and eventSource telemetry identifying the specific API action.
references:
- https://docs.aws.amazon.com/accounts/latest/reference/API_EnableRegion.html
- https://awscli.amazonaws.com/v2/documentation/api/2.14.0/reference/account/enable-region.html
- https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/aws/cloudtrail/aws_cloudtrail_region_enabled.yml
author: Ivan Saakov, Sergey Zelenskiy, Huntrule Team
date: 2025-10-19
tags:
- attack.persistence
logsource:
product: aws
service: cloudtrail
detection:
selection:
eventName: EnableRegion
eventSource: account.amazonaws.com
condition: selection
falsepositives:
- Legitimate use of the EnableRegion command by authorized administrators.
level: medium
license: DRL-1.1
related:
- id: a5ffb6ea-c784-4e01-b30a-deb6e58ca2ab
type: derived