<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: implementing-cloud-cost-anomaly-detection
description: >-
  Implement cloud cost anomaly detection to identify cryptomining, resource
  abuse, compromised credentials, and shadow IT through billing spike
  analysis across AWS Cost Explorer, GCP Billing, and Azure Cost Management.
domain: cybersecurity
subdomain: cloud-native-security
tags:
  - cost-anomaly
  - cryptomining
  - billing
  - resource-abuse
  - cloud-security
  - finops
  - threat-detection
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1496"]
---

# Implementing Cloud Cost Anomaly Detection

## Overview

Implement cloud cost anomaly detection to identify cryptomining, resource abuse, compromised credentials, and shadow IT through billing spike analysis across AWS Cost Explorer, GCP Billing, and Azure Cost Management.

Mode: `[MODE: BLUE]` — Detect cost anomalies. `[MODE: INCIDENT]` — Triage billing spikes.

## Prerequisites

| Requirement | Details |
|---|---|
| AWS Cost Explorer / GCP Billing / Azure Cost Management access | Required |
| Billing alerts configured | Required |
| CloudWatch or equivalent monitoring | Required |

## Key Concepts

### AWS Cost Anomaly Detection

```bash
# Create cost anomaly monitor
aws ce create-anomaly-monitor \
  --anomaly-monitor '{"MonitorName": "security-monitor",
    "MonitorType": "DIMENSIONAL", "MonitorDimension": "SERVICE"}'

# Query recent anomalies
aws ce get-anomalies \
  --date-interval '{"StartDate": "2026-01-01", "EndDate": "2026-03-18"}'

# Check cost by service (spot crypto mining)
aws ce get-cost-and-usage \
  --time-period Start=2026-03-01,End=2026-03-18 \
  --granularity DAILY --metrics BlendedCost \
  --group-by Type=DIMENSION,Key=SERVICE
```

### Detect Cryptomining Indicators

```bash
# Find GPU instances (cryptomining indicator)
aws ec2 describe-instances \
  --filters "Name=instance-type,Values=p3.*,p4.*,g4dn.*,g5.*" \
  --query 'Reservations[].Instances[].{{Id:InstanceId,Type:InstanceType,Launch:LaunchTime}}'

# Check for resources in unused regions
aws ec2 describe-instances --region us-west-1 --output json
```

### GCP Budget Alerts

```bash
gcloud billing budgets create \
  --billing-account=ACCOUNT_ID \
  --display-name="Security Alert Budget" \
  --budget-amount=1000 \
  --threshold-rule=percent=0.5 \
  --threshold-rule=percent=0.9
```

## Workflow

```bash
node scripts/agent.js --action audit --namespace production
cat /tmp/implementing-cloud-cost-anomaly-detection-audit.json | jq '.findings[]'
```

## Detection

```yaml
title: Cloud Cost Anomaly Detection Detection
id: 50cdc72d-3381-4253-af8a-8ed9d4d801a4
status: experimental
description: Detects suspicious activity related to implementing cloud cost anomaly detection techniques in cloud native security context
logsource:
  product: kubernetes
  service: audit
detection:
  selection:
    eventName: "*Unauthorized*"
  condition: selection
level: medium
tags:
  - attack.t1496
  - attack.privilege_escalation
falsepositives:
  - Kubernetes controller reconciliation loops during cluster updates
```


**Detection Opportunities**

| Indicator | Source | Detection Logic |
|---|---|---|
| Cloud Cost Anomaly Detection Detection | kubernetes | Sigma rule (medium) |
| ATT&CK Coverage | MITRE ATT&CK | T1496 |

## Verification

- [ ] Cost anomaly monitors active for all services
- [ ] Budget thresholds set at 50%, 90%, and 100%
- [ ] GPU/compute instance creation alerts in CloudTrail
- [ ] Unused region monitoring enabled
- [ ] Weekly cost review includes security team
- [ ] Immediate alert on anomaly > $100 impact

## References

- [AWS Cost Anomaly Detection](https://docs.aws.amazon.com/cost-management/latest/userguide/manage-ad.html)
- [GCP Budget Alerts](https://cloud.google.com/billing/docs/how-to/budgets)
- [Azure Cost Anomaly Detection](https://learn.microsoft.com/en-us/azure/cost-management-billing/understand/analyze-unexpected-charges)
- [MITRE ATT&CK T1496 — Resource Hijacking](https://attack.mitre.org/techniques/T1496/)
