huntrule

AWS EC2 ModifyInstanceAttribute userData Startup Script Change

Detects CloudTrail EC2 userData startup script changes made via ModifyInstanceAttribute.

FreeReviewedSigma · High · v5
Product
aws
Service
cloudtrail
Author
faloker (SigmaHQ), DRL 1.1
Published
2020-02-12
Updated
2026-07-31
AnalysisDetection

ATT&CK techniques

Execution

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule flags CloudTrail events where an EC2 instance attribute is modified to change the instance userData. Because EC2 userData can contain startup scripts that run with elevated privileges at boot, unauthorized or unexpected changes can provide persistence or remote execution. Detection relies on CloudTrail records for ModifyInstanceAttribute with requestParameters indicating the userData attribute.

Reporting behind it

Related detections9 linkedT1059.001 — drag to rearrange
Suspicious ClickFix Command Execution via RunMRU Registry Key
Malicious WSUS Service Spawning Command Shell via CVE-2025-59287 (via process_creation)
Malicious SharePoint w3wp Spawning Command Shell and PowerShell
Malicious IIS w3wp Worker Spawning Command Interpreter via SharePoint Web Shell
Malicious ClickFix Execution via Headless Conhost
Exchange Worker Process Spawning Command Shell via OWASSRF
Suspicious Hidden PowerShell Launched by Batch Script
MSSQL Server Process Spawning Command Shell via xp_cmdshell
Suspicious MSSQL xp_cmdshell OS Command Execution via sqlservr.exe (via process_creation)
AWS EC2 ModifyInstanceAttribute userData Startup Script Change
Pivot detection · T1059.001 · 9 related

Changelog

v5
  1. v5
    Candidate ingested via manual entry.2026-07-31
  2. v4
    Candidate ingested via manual entry.2026-07-31
  3. v3
    Candidate ingested via manual entry.2026-07-31
  4. v2
    Candidate ingested via manual entry.2026-07-31
  5. v1
    No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.