AWSCloudTrail - EC2 Startup Shell Script Changed

Identifies changes to the EC2 startup script. The shell script will be executed as root/SYSTEM every time the specific instances are booted up. ref :…

Description

Identifies changes to the EC2 startup script. The shell script will be executed as root/SYSTEM every time the specific instances are booted up. ref : https://github.com/RhinoSecurityLabs/pacu/blob/master/pacu/modules/ec2__startup_shell_script/main.py

Detection logic

Detection requirements

Platform: Containers ESXi IaaS Identity Provider Linux macOS Network Devices Office Suite SaaS Windows
The rule states no platform. This is derived from the ATT&CK technique it maps to.
Log source product: aws
Log source service: awscloudtrail

Detection rules

AWSCloudTrail - EC2 Startup Shell Script Changed

Description

Detection logic

Detection requirements

MITRE ATT&CK mappings

From the source

Licence

Authorship

Detection rules