Suspicious activity

Anomaly detection: User creating instances with malware

Risk Level

Imminent Compromised (2)



Unlike in the past, the user created instances in an amount which is unusual to its regular activity. It was found that few of those EC2 instances contain malware. It is possible that the role was hijacked and used to create instances for malicious purposes in the environment, cryptomining for example.
  • Recommended Mitigation

    It is recommended to review the actions of the role and remediate the infected instances. It is also recommended to check in the relevant AuditLog events which entity used the role permissions to create the infected instances.