AWS EC2 Launch Unusual EC2 Instances

Description

Detect when an actor deploys an EC2 instance with an unusual profile based on your business needs.

Query · python

from collections.abc import Mapping

from panther_aws_helpers import aws_cloudtrail_success, aws_rule_context
from panther_core import PantherEvent

# Configuration Required
#   Add/remove items from the set below as needed. It should contain instance types which aren't
#   expected to be used in your environment
UNUSUAL_INSTANCE_TYPES = {
    "p2.xlarge"  # Large GPU compute, but no graphics - could be used for crypt mining
}


def rule(event: PantherEvent) -> bool:
    return (
        event.get("eventSource") == "ec2.amazonaws.com"
        and event.get("eventName") == "RunInstances"
        and get_instance_type(event) in get_unusual_instance_types()
    )


def title(event: PantherEvent) -> str:
    # The actor in these events is always AutoScalingService
    account = event.get("recipientAccountId")
    instance_type = get_instance_type(event)
    return f"EC2 instance with a suspicious type '{instance_type}' was launched in in {account}"


def severity(event: PantherEvent) -> str:
    if not aws_cloudtrail_success(event):
        return "LOW"
    return "DEFAULT"


def alert_context(event: PantherEvent) -> dict:
    context = aws_rule_context(event)
    context["instanceType"] = get_instance_type(event)
    return context


def get_unusual_instance_types() -> set[str]:
    # Making this a separate function allows us to mock it during unit tests for reliable testing!
    return UNUSUAL_INSTANCE_TYPES


def get_instance_type(event: PantherEvent) -> str:
    # Return the type of the instance that was launch
    instance_type = event.deep_get(
        "requestParameters", "instanceType", default="<UNKNOWN INSTANCE TYPE>"
    )
    # instanceType could be a string or a dict
    if isinstance(instance_type, Mapping):
        instance_type = instance_type.get("value", "<UNKNOWN INSTANCE TYPE>")
    return instance_type

Analyst notes

Follow up with the instance to identify whether the instance has a legitimate purpose. Reach out to the actor to ensure they performed the action.

Detection tier

Atomic IOCs
Network & Host Artifacts
Tools
TTPs
Pending classification

Metadata

Source: panther-labs/panther-analysis
License: Apache 2.0
Severity: Informational
Status: Stable
Query type: python
Created: 2025-01-28
Modified: 2026-03-02
Authored by: panther-labs
Source ID
Upstream: rules/aws_cloudtrail_rules/aws_ec2_launch_unusual_ec2_instances.yml
Type: rule
Version: 3
References: https://stratus-red-team.cloud/attack-techniques/AWS/aws.execution.ec2-launch-unusual-instances/
Data sources: AWS.CloudTrail

ATT&CK

TA0002 T1610