AWS EC2 Startup Shell Script Change

Title: AWS EC2 Startup Shell Script Change
Status: test
Description:Detects changes to the EC2 instance startup script. The shell script will be executed as root/SYSTEM every time the specific instances are booted up.
References:
  -https://github.com/RhinoSecurityLabs/pacu/blob/866376cd711666c775bbfcde0524c817f2c5b181/pacu/modules/ec2__startup_shell_script/main.py#L9
Author: faloker
Date: 2020-02-12
modified:2022-06-07
Tags:

• -'attack.execution'
• -'attack.t1059.001'
• -'attack.t1059.003'
• -'attack.t1059.004'

Logsource:

• product: aws
• service: cloudtrail

Detection:
  selection_source:
    eventSource: 'ec2.amazonaws.com'
    requestParameters.attribute: 'userData'
    eventName: 'ModifyInstanceAttribute'
  condition:selection_source
Falsepositives:
  -Valid changes to the startup script
Level: high