Retrieval of cloud compute EC2 instance user data

Analytics BIOC Informational

Retrieval of cloud compute EC2 instance user data

A cloud compute instance user data was retrieved, which may contain startup scripts, configuration parameters, or sensitive information associated with the instance.

Module:: Cortex Cloud
Licensed by:: Cloud Runtime Security (CRS)
Data source:: AWS Audit Log

ATT&CK tactics: Collection (TA0009)

ATT&CK techniques: Automated Collection (T1119)

Attacker's goals:

Access sensitive instance metadata or startup scripts.

Investigative actions:

Verify whether this action is expected. Inspect the user data script for sensitive data.

Test period:: N/A (single event)
Deduplication:: 1 Day

1 variation:

Unusual Retrieval of cloud compute instance user data Low (parent: Informational)