Detection catalogue

Explore published rules with transparent provenance, licensing, and ATT&CK mappings.

detections

Loading detections…

AWSCloudTrail - EC2 Startup Shell Script Changed

Identifies changes to the EC2 startup script. The shell script will be executed as root/SYSTEM every time the specific instances are booted up. ref : https://github.com/RhinoSecurityLabs/pacu/blob/master/pacu/modules/ec2__startup_shell_script/main.py

ATT&CK coverage

Execution

T1059Command and Scripting Interpreter 488 detections cover this technique

Detection requirements

Log source product: aws
Log source service: awscloudtrail

What the source says

Tagged by the source as

Execution

Detection logic

Published to signed-in readers

The query as its source wrote it, its canonical form, and the content hash that pins this exact revision.