EC2 Startup Shell Script Changed

Back


Id	f8577e4d-8481-437b-a94e-06f615985668
Rulename	EC2 Startup Shell Script Changed
Description	Detects changes to the EC2 startup script. The shell script will be executed as root/SYSTEM every time the specific instances are booted up. ref : https://github.com/RhinoSecurityLabs/pacu/blob/master/pacu/modules/ec2__startup_shell_script/main.py
Severity	Medium
Tactics	Execution
Techniques	T1059
Required data connectors	AWS
Kind	Scheduled
Query frequency	15m
Query period	15m
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Amazon Web Services/Analytic Rules/AWS_EC2StartupShellScriptChanged.yaml
Version	1.0.0
Arm template	f8577e4d-8481-437b-a94e-06f615985668.json

KQL

AWSCloudTrail
| where EventName == "ModifyInstanceAttribute" or EventName == "CreateLaunchTemplate"
| where RequestParameters contains "userData"
| extend userData_ = tostring(parse_json(RequestParameters).userData)
| extend instanceId_ = tostring(parse_json(RequestParameters).instanceId)
| project-away  SourceSystem,Category,Type,TenantId,EventVersion,SessionIssuerAccountId
| extend UserName = substring(UserIdentityPrincipalid, indexof_regex(UserIdentityPrincipalid, ":") + 1)
| extend Name = split(UserName,'@')[0],UpnSuffix = split(UserName,'@')[1]

YAML

triggerThreshold: 0
entityMappings:
- entityType: Account
  fieldMappings:
  - identifier: Name
    columnName: Name
  - identifier: UPNSuffix
    columnName: UpnSuffix
- entityType: IP
  fieldMappings:
  - identifier: Address
    columnName: SourceIpAddress
requiredDataConnectors:
- dataTypes:
  - AWSCloudTrail
  connectorId: AWS
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Amazon Web Services/Analytic Rules/AWS_EC2StartupShellScriptChanged.yaml
name: EC2 Startup Shell Script Changed
relevantTechniques:
- T1059
status: Available
version: 1.0.0
queryPeriod: 15m
kind: Scheduled
id: f8577e4d-8481-437b-a94e-06f615985668
query: |
  AWSCloudTrail
  | where EventName == "ModifyInstanceAttribute" or EventName == "CreateLaunchTemplate"
  | where RequestParameters contains "userData"
  | extend userData_ = tostring(parse_json(RequestParameters).userData)
  | extend instanceId_ = tostring(parse_json(RequestParameters).instanceId)
  | project-away  SourceSystem,Category,Type,TenantId,EventVersion,SessionIssuerAccountId
  | extend UserName = substring(UserIdentityPrincipalid, indexof_regex(UserIdentityPrincipalid, ":") + 1)
  | extend Name = split(UserName,'@')[0],UpnSuffix = split(UserName,'@')[1]  
description: |
    'Detects changes to the EC2 startup script. The shell script will be executed as root/SYSTEM every time the specific instances are booted up. ref : https://github.com/RhinoSecurityLabs/pacu/blob/master/pacu/modules/ec2__startup_shell_script/main.py'
queryFrequency: 15m
severity: Medium
triggerOperator: gt
tactics:
- Execution

ARM