Suspicious AWS EnableRegion Command Monitoring (via cloudtrail)

title: Suspicious AWS EnableRegion Command Monitoring (via cloudtrail)
id: 7b1dfda2-f07d-5faa-aaf3-fa8ce5b43792
status: stable
description: This rule detects the use of the EnableRegion command in AWS CloudTrail logs. While AWS has 30+ regions, some of them are enabled by default, others must be explicitly enabled in each account separately. There may be situations where security monitoring does not cover some new AWS regions. Monitoring the EnableRegion command is important for identifying potential persistence mechanisms employed by adversaries, as enabling additional regions can facilitate continued access and operations within an AWS environment.
references:
    - https://docs.aws.amazon.com/accounts/latest/reference/API_EnableRegion.html
    - https://awscli.amazonaws.com/v2/documentation/api/2.14.0/reference/account/enable-region.html
author: Huntrule Team
date: 2026-03-04
tags:
    - attack.persistence
    - attack.defense-evasion
    - attack.t1535
logsource:
    product: aws
    service: cloudtrail
detection:
    selection:
        eventName: 'EnableRegion'
        eventSource: 'account.amazonaws.com'
    condition: selection
falsepositives:
    - Unknown
level: medium