{"id":"1ab3c5ed-5baf-417b-bb6b-78ca33f6c3df","title":"AWS EC2 Startup Shell Script Change","description":"Detects changes to the EC2 instance startup script. The shell script will be executed as root/SYSTEM every time the specific instances are booted up.","author":"faloker","status":"test","level":"high","date":"2020-02-12","modified":"2022-06-07","tags":["attack.execution","attack.t1059.001","attack.t1059.003","attack.t1059.004"],"technique_ids":["T1059.001","T1059.003","T1059.004"],"logsource":{"product":"aws","service":"cloudtrail"},"falsepositives":["Valid changes to the startup script"],"references":["https://github.com/RhinoSecurityLabs/pacu/blob/866376cd711666c775bbfcde0524c817f2c5b181/pacu/modules/ec2__startup_shell_script/main.py#L9"],"source_path":"rules/cloud/aws/cloudtrail/aws_ec2_startup_script_change.yml","source_sha256":"8b58ce7431b1b3964cf0239c95164d92c9ce51c941101f70d901f7ff3b71b727","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/cloud/aws/cloudtrail/aws_ec2_startup_script_change.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: AWS EC2 Startup Shell Script Change\nid: 1ab3c5ed-5baf-417b-bb6b-78ca33f6c3df\nstatus: test\ndescription: Detects changes to the EC2 instance startup script. The shell script will be executed as root/SYSTEM every time the specific instances are booted up.\nreferences:\n    - https://github.com/RhinoSecurityLabs/pacu/blob/866376cd711666c775bbfcde0524c817f2c5b181/pacu/modules/ec2__startup_shell_script/main.py#L9\nauthor: faloker\ndate: 2020-02-12\nmodified: 2022-06-07\ntags:\n    - attack.execution\n    - attack.t1059.001\n    - attack.t1059.003\n    - attack.t1059.004\nlogsource:\n    product: aws\n    service: cloudtrail\ndetection:\n    selection_source:\n        eventSource: ec2.amazonaws.com\n        requestParameters.attribute: 'userData'\n        eventName: ModifyInstanceAttribute\n    condition: selection_source\nfalsepositives:\n    - Valid changes to the startup script\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1059.001","id":"T1059.001","name":"PowerShell","page":"techniques/enterprise/T1059.001/"},{"key":"enterprise/T1059.003","id":"T1059.003","name":"Windows Command Shell","page":"techniques/enterprise/T1059.003/"},{"key":"enterprise/T1059.004","id":"T1059.004","name":"Unix Shell","page":"techniques/enterprise/T1059.004/"}],"data_path":"data/detection-rules/1ab3c5ed-5baf-417b-bb6b-78ca33f6c3df.json","kind":"sigma"}