Running EC2 instances in a Region outside your scan list
HIGH / MEDIUMWhat's the problem
Unexpected instances in an unused Region are a common sign of leaked keys used for crypto-mining; Cost Explorer usually shows it 4–24 hours later. HIGH if one launched in the last 30 days, MEDIUM otherwise (6WAF classification)
How 6WAF detects it
- Deterministic checks through AWS API calls (IAM, S3, EC2/VPC, CloudTrail, KMS) — no LLM is used for detection; severity is the value the scanner assigns, shown above.
- Scanning uses an IAM Role you deploy yourself via CloudFormation; 6WAF stores no credentials and you revoke access any time by deleting the stack.
- Automated scoring covers only part of the scope of standards such as ISO 27001 — this is a technical assessment, not a certification.
Pillar: Security — Fast Scan
Group: Threat detection (GuardDuty, Regions outside the scan)
Scan this check (and the other 91) automatically in ~10 minutes
Start free