huntrule

AWS EC2 ModifyInstanceAttribute userData Startup Script Change

Detects CloudTrail EC2 userData startup script changes made via ModifyInstanceAttribute.

FreeReviewedSigma · High · v5
Product
aws
Service
cloudtrail
Author
faloker (SigmaHQ), DRL 1.1
Published
2020-02-12
Updated
2026-07-31
AnalysisDetection

ATT&CK techniques

Execution

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule flags CloudTrail events where an EC2 instance attribute is modified to change the instance userData. Because EC2 userData can contain startup scripts that run with elevated privileges at boot, unauthorized or unexpected changes can provide persistence or remote execution. Detection relies on CloudTrail records for ModifyInstanceAttribute with requestParameters indicating the userData attribute.

Reporting behind it

Related detections9 linkedT1059.001 — drag to rearrange
MSSQL Server Process Spawning Command Shell via xp_cmdshell
Suspicious MSSQL xp_cmdshell OS Command Execution via sqlservr.exe (via process_creation)
Malicious Fire Ant Host-to-Guest Command Execution via VMware Tools (via process_creation)
Malicious Office Application Spawning a Command Shell or Script Interpreter (via process_creation)
Cleo File Transfer Software Spawning Command Interpreter
Malicious PowerShell or Command Shell Spawned by SQL Server via xp_cmdshell
Windows AppLocker Audit-Mode Events Indicate Files Would Have Been Blocked
Windows Process Creation: CrushFTP spawning PowerShell, CMD, and scripting tool execution
Windows: Suspicious child processes spawned by CrushFTP service
AWS EC2 ModifyInstanceAttribute userData Startup Script Change
Pivot detection · T1059.001 · 9 related

Changelog

v5
  1. v5
    Candidate ingested via manual entry.2026-07-31
  2. v4
    Candidate ingested via manual entry.2026-07-31
  3. v3
    Candidate ingested via manual entry.2026-07-31
  4. v2
    Candidate ingested via manual entry.2026-07-31
  5. v1
    No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.