Retrieval of cloud compute EC2 instance user data

Synopsis

Field	Value
Activation Period	14 Days
Training Period	30 Days
Test Period	N/A (single event)
Deduplication Period	1 Day
Required Data	AWS Audit Log
Detection Modules	Cloud
ATT&CK Tactic	Collection (TA0009)
ATT&CK Technique	Automated Collection (T1119)
Severity	Informational

Description

A cloud compute instance user data was retrieved, which may contain startup scripts, configuration parameters, or sensitive information associated with the instance.

Attacker's Goals

Access sensitive instance metadata or startup scripts.

Investigative actions

• Verify whether this action is expected.
• Inspect the user data script for sensitive data.

Variations

Unusual Retrieval of cloud compute instance user data

Synopsis

Field	Value
ATT&CK Tactic	Collection (TA0009)
ATT&CK Technique	Automated Collection (T1119)
Severity	Low

Description

A cloud compute instance user data was retrieved, which may contain startup scripts, configuration parameters, or sensitive information associated with the instance.

Attacker's Goals

Access sensitive instance metadata or startup scripts.

Investigative actions

• Verify whether this action is expected.
• Inspect the user data script for sensitive data.