Cloud Instance Configuration Modified for Evasion

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•3

This rule detects attempts to modify an EC2 instance's attributes, specifically looking for the 'ModifyInstanceAttribute' API call to 'ec2.amazonaws.com'. This activity could indicate an attacker attempting to evade detection or alter the instance's configuration for malicious purposes.