AWS EC2 Startup Shell Script Modification

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•29

Detects changes to the EC2 instance startup script (User Data). The shell script will be executed as root/SYSTEM every time the specific instances are booted up, allowing for persistence and execution of arbitrary commands.