EC2 Startup Shell Script Changed

Back


Id	f8577e4d-8481-437b-a94e-06f615985668
Rulename	EC2 Startup Shell Script Changed
Description	Detects changes to the EC2 startup script. The shell script will be executed as root/SYSTEM every time the specific instances are booted up. ref : https://github.com/RhinoSecurityLabs/pacu/blob/master/pacu/modules/ec2__startup_shell_script/main.py
Severity	Medium
Tactics	Execution
Techniques	T1059
Required data connectors	AWS
Kind	Scheduled
Query frequency	15m
Query period	15m
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Amazon Web Services/Analytic Rules/AWS_EC2StartupShellScriptChanged.yaml
Version	1.0.0
Arm template	f8577e4d-8481-437b-a94e-06f615985668.json

KQL

AWSCloudTrail
| where EventName == "ModifyInstanceAttribute" or EventName == "CreateLaunchTemplate"
| where RequestParameters contains "userData"
| extend userData_ = tostring(parse_json(RequestParameters).userData)
| extend instanceId_ = tostring(parse_json(RequestParameters).instanceId)
| project-away  SourceSystem,Category,Type,TenantId,EventVersion,SessionIssuerAccountId
| extend UserName = substring(UserIdentityPrincipalid, indexof_regex(UserIdentityPrincipalid, ":") + 1)
| extend Name = split(UserName,'@')[0],UpnSuffix = split(UserName,'@')[1]

YAML

description: |
    'Detects changes to the EC2 startup script. The shell script will be executed as root/SYSTEM every time the specific instances are booted up. ref : https://github.com/RhinoSecurityLabs/pacu/blob/master/pacu/modules/ec2__startup_shell_script/main.py'
kind: Scheduled
tactics:
- Execution
requiredDataConnectors:
- connectorId: AWS
  dataTypes:
  - AWSCloudTrail
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Amazon Web Services/Analytic Rules/AWS_EC2StartupShellScriptChanged.yaml
severity: Medium
name: EC2 Startup Shell Script Changed
triggerThreshold: 0
queryPeriod: 15m
query: |
  AWSCloudTrail
  | where EventName == "ModifyInstanceAttribute" or EventName == "CreateLaunchTemplate"
  | where RequestParameters contains "userData"
  | extend userData_ = tostring(parse_json(RequestParameters).userData)
  | extend instanceId_ = tostring(parse_json(RequestParameters).instanceId)
  | project-away  SourceSystem,Category,Type,TenantId,EventVersion,SessionIssuerAccountId
  | extend UserName = substring(UserIdentityPrincipalid, indexof_regex(UserIdentityPrincipalid, ":") + 1)
  | extend Name = split(UserName,'@')[0],UpnSuffix = split(UserName,'@')[1]  
relevantTechniques:
- T1059
id: f8577e4d-8481-437b-a94e-06f615985668
queryFrequency: 15m
status: Available
triggerOperator: gt
version: 1.0.0
entityMappings:
- entityType: Account
  fieldMappings:
  - columnName: Name
    identifier: Name
  - columnName: UpnSuffix
    identifier: UPNSuffix
- entityType: IP
  fieldMappings:
  - columnName: SourceIpAddress
    identifier: Address

ARM