AWS EC2 Startup Script (userData) Modified via ModifyInstanceAttribute

Detects CloudTrail EC2 userData startup script changes made via ModifyInstanceAttribute.

FreeUnreviewedSigmahighv1

aws-ec2-startup-script-userdata-modified-via-modifyinstanceattribute-1ab3c5ed

title: AWS EC2 Startup Script (userData) Modified via ModifyInstanceAttribute
id: d8254703-95b6-4a7b-8bf9-ded8d5f509f7
status: test
description: This rule flags CloudTrail events where an EC2 instance’s userData (startup script) is modified through ModifyInstanceAttribute. Because userData startup scripts are executed with high privileges on boot, an attacker can persist commands that run on every instance restart. The detection relies on AWS CloudTrail fields indicating the EC2 API event and the specific request parameter that carries userData updates.
references:
  - https://github.com/RhinoSecurityLabs/pacu/blob/866376cd711666c775bbfcde0524c817f2c5b181/pacu/modules/ec2__startup_shell_script/main.py#L9
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/aws/cloudtrail/aws_ec2_startup_script_change.yml
author: faloker, Huntrule Team
date: 2020-02-12
modified: 2022-06-07
tags:
  - attack.execution
  - attack.t1059.001
  - attack.t1059.003
  - attack.t1059.004
logsource:
  product: aws
  service: cloudtrail
detection:
  selection_source:
    eventSource: ec2.amazonaws.com
    requestParameters.attribute: userData
    eventName: ModifyInstanceAttribute
  condition: selection_source
falsepositives:
  - Valid changes to the startup script
level: high
license: DRL-1.1
related:
  - id: 1ab3c5ed-5baf-417b-bb6b-78ca33f6c3df
    type: derived

What it detects

This rule flags CloudTrail events where an EC2 instance’s userData (startup script) is modified through ModifyInstanceAttribute. Because userData startup scripts are executed with high privileges on boot, an attacker can persist commands that run on every instance restart. The detection relies on AWS CloudTrail fields indicating the EC2 API event and the specific request parameter that carries userData updates.

Known false positives

Valid changes to the startup script

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.