Analytics BIOC Informational

Cloud compute instance user data script modification

The user data of a cloud compute instance was modified.

Module:
Cortex Cloud
Licensed by:
Cloud Runtime Security (CRS)
Data source:
AWS Audit Log, Gcp Audit Log
ATT&CK tactics: Execution (TA0002)
ATT&CK techniques: Cloud Administration Command (T1651)
Attacker's goals:

Execute commands within virtual machines.

Investigative actions:

Verify whether this action is expected. Inspect the user data script for malicious content.

Test period:
N/A (single event)
Deduplication:
1 Day
1 variation:
  • Unusual Cloud compute instance user data script modification Low (parent: Informational)