AWS EC2 ModifyInstanceAttribute userData Startup Script Change
Detects CloudTrail EC2 userData startup script changes made via ModifyInstanceAttribute.
- Product
- aws
- Service
- cloudtrail
- Author
- faloker (SigmaHQ), DRL 1.1
- Published
- 2020-02-12
- Updated
- 2026-07-31
ATT&CK techniques
ExecutionRecon
Resource Dev
Initial Access
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags CloudTrail events where an EC2 instance attribute is modified to change the instance userData. Because EC2 userData can contain startup scripts that run with elevated privileges at boot, unauthorized or unexpected changes can provide persistence or remote execution. Detection relies on CloudTrail records for ModifyInstanceAttribute with requestParameters indicating the userData attribute.
Reporting behind it
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: AWS EC2 ModifyInstanceAttribute userData Startup Script Change
id: d8254703-95b6-4a7b-8bf9-ded8d5f509f7
status: test
description: This rule flags CloudTrail events where an EC2 instance attribute is modified to change the instance userData. Because EC2 userData can contain startup scripts that run with elevated privileges at boot, unauthorized or unexpected changes can provide persistence or remote execution. Detection relies on CloudTrail records for ModifyInstanceAttribute with requestParameters indicating the userData attribute.
references:
- https://github.com/RhinoSecurityLabs/pacu/blob/866376cd711666c775bbfcde0524c817f2c5b181/pacu/modules/ec2__startup_shell_script/main.py#L9
- https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/aws/cloudtrail/aws_ec2_startup_script_change.yml
author: faloker, Huntrule Team
date: 2020-02-12
modified: 2022-06-07
tags:
- attack.execution
- attack.t1059.001
- attack.t1059.003
- attack.t1059.004
logsource:
product: aws
service: cloudtrail
detection:
selection_source:
eventSource: ec2.amazonaws.com
requestParameters.attribute: userData
eventName: ModifyInstanceAttribute
condition: selection_source
falsepositives:
- Valid changes to the startup script
level: high
license: DRL-1.1
related:
- id: 1ab3c5ed-5baf-417b-bb6b-78ca33f6c3df
type: derived