---
{
  "title": "Unused/Unsupported Cloud Regions",
  "summary": "Unused cloud region abuse creates resources where normal operations and monitoring may be sparse.",
  "topic": "soc",
  "level": "Intermediate",
  "updated": "2026-10-12",
  "published": "2026-10-04",
  "units": [
    6
  ],
  "aliases": [
    "T1535"
  ],
  "sources": [
    {
      "title": "MITRE ATT&CK T1535: Unused/Unsupported Cloud Regions",
      "url": "https://attack.mitre.org/techniques/T1535"
    }
  ],
  "editorialVersion": 2
}
---

## What it means

Unused cloud region abuse creates resources where normal operations and monitoring may be sparse. Account-wide visibility matters even when the business uses only a few regions.


## An investigation example

A compromised identity launches resources in a region absent from the approved deployment inventory.

## Evidence to examine

Review region-wide audit events, resource creation, identity changes, billing, and whether collection covers the new region.

## A common analytical pitfall

An unfamiliar region can be a legitimate expansion; compare activity with approved changes.

## Response considerations

Remove confirmed unauthorized resources, preserve evidence, and close regional visibility and permission gaps relevant to the incident.


## Geographic scope can become a monitoring gap

Cloud accounts may support regions that an organization does not normally use. An intruder with sufficient authority may create or operate resources where local monitoring, ownership, or review is less mature. The concern is a mismatch between available capability and the organization's intended operating boundary, not that a particular region is inherently unsafe.

Providers differ in regional services, logging, account controls, and configuration. Verify the actual platform rather than assume a setting automatically covers every location. An unused region can still generate charges or host resources if the account permits it. Conversely, a service may be global rather than tied to one region.

## A fictional unexpected instance

An academy's billing review reveals compute usage in a region outside its approved deployment footprint. Analysts preserve resource-creation events, initiating identity, configuration, tags, and activity. They compare the resource with disaster-recovery testing and approved experiments before concluding that it is unauthorized.

Deleting the resource may stop immediate cost but does not explain how it was created or whether other regions are affected. Review credentials, permissions, account-wide visibility, and the approval process. Preserve relevant evidence and coordinate with service owners so legitimate recovery capacity is not removed by mistake.

## Define the intended footprint

Draw a fictional account with two approved regions and one unused region. Mark where inventory, audit records, spending alerts, and deployment controls apply. Identify one assumption that requires verification with official platform documentation. Then explain how you would investigate an unexpected resource without relying only on a regional dashboard.

The goal is consistent account governance across the capability the organization actually exposes. Restrict unnecessary deployment options where appropriate, maintain visibility, and test exceptions through the approved process. A written list of approved regions is useful only if operations and monitoring can detect or prevent deviations.

## Related concepts

- [[mitre-attack]]
- [[logs-and-telemetry]]
- [[incident-response]]
- [[resource-hijacking]]