AWS EC2 User Data Modified
This rule detects modifications to the user data script of an EC2 instance in AWS. User data scripts are executed when an EC2 instance is launched and can be used to perform initial setup, install software, or run other commands. An adversary modifying this script could achieve persistence or privilege escalation by injecting malicious commands that run upon the next instance boot.
YARA-L
