Detection of Anomalous AWS Service Quota Increases
Adversaries with compromised AWS credentials may request service quota increases to facilitate large-scale malicious operations, detectable by identifying rare identities invoking the RequestServiceQuotaIncrease API.
Adversaries who obtain AWS credentials often perform resource development as a prerequisite for larger campaigns. By requesting AWS Service Quota increases, attackers can bypass default account limits that are intended to prevent runaway resource consumption. Increasing these limits allows for the deployment of industrial-scale infrastructure for activities such as cryptomining, DDoS amplification, high-volume phishing through Amazon SES, or large-scale credential stuffing using Lambda.
Defenders should monitor the AWS Service Quotas API for the 'RequestServiceQuotaIncrease' action, specifically focusing on identities that have no recent history (within a 7-day window) of performing such requests. Because legitimate cloud infrastructure teams also perform these tasks, filtering by common Infrastructure-as-Code (IaC) toolsets like Terraform, Pulumi, or Ansible is critical to reduce false positives.
Impact
Successful exploitation of service quotas enables attackers to scale malicious operations beyond the organization's expected capacity. This can lead to significant financial costs due to unauthorized resource usage, increased exposure to downstream abuse reports for phishing, or the compromise of internal data through high-bandwidth exfiltration channels.
Recommendation
Detection engineering teams should implement monitoring for rare AWS Service Quota increase requests to identify potential malicious infrastructure preparation.
- Deploy detection logic to monitor 'RequestServiceQuotaIncrease' events in AWS CloudTrail for identities without a 7-day history of this API call.
- Filter out service principals or IAM roles used by known IaC tools (e.g., Terraform, Pulumi, Ansible) to minimize noise.
- Investigate triggered alerts by cross-referencing the requesting identity with recent activity in the affected services (EC2, Lambda, SES).
- Use AWS Service Control Policies (SCPs) to restrict 'servicequotas:RequestServiceQuotaIncrease' to authorized cloud-operations roles only.
Immediate actions
Review existing AWS CloudTrail logging for RequestServiceQuotaIncrease events
Mitigations
Implement Service Control Policies (SCP) to restrict quota increase requests to approved roles
Unauthorized quota modification