Detects the first time an AWS identity requests a service quota increase via the AWS Service Quotas API within a rolling 7-day history window. It analyzes AWS CloudTrail logs (logs-aws.cloudtrail-*) for events from servicequotas.amazonaws.com with action RequestServiceQuotaIncrease and outcome success, excluding requests originating from common IaC tools (Terraform, Pulumi, Ansible, CloudFormation) based on the user_agent. A match is reported as a new-term event and includes the identity (aws.cloudtrail.user_identity.arn / user.name), the targeted service (serviceCode), quota (quotaCode), and the requested value. This rule is intended to detect adversaries who obtain credentials to scale infrastructure, enabling cryptomining, DDoS amplification, phishing campaigns, or data exfiltration by surpassing current limits. It maps to MITRE ATT&CK T1583 Acquire Infrastructure / TA0042 Resource Development.