StopInstance WITH ModifyInstanceAttributes

Description

Identifies when StopInstance and ModifyInstanceAttributes CloudTrail events occur in a short period of time. Since EC2 startup scripts cannot be modified without first stopping the instance, StopInstances should be a signal.

Query

Detection:
    - Group:
        - ID: StopInstance
          RuleID: AWS.EC2.StopInstances
        - ID: StartupScriptChange
          RuleID: AWS.EC2.Startup.Script.Change
      MatchCriteria:
        field_name:
          - GroupID: StopInstance
            Match: p_alert_context.instance_ids
          - GroupID: StartupScriptChange
            Match: p_alert_context.instance_ids
      LookbackWindowMinutes: 1800
      Schedule:
        RateMinutes: 1440
        TimeoutMinutes: 5

Rule dependencies

⚠ Higher-order rule. It fires on other rules' alerts, not on raw events, so it cannot fire on its own. Deploy the rules it depends on too.

Depends on

Raw source StopInstance WITH ModifyInstanceAttributes · Panther Python
Esc
Published by panther-labs/panther-analysis ↗, licensed under Apache 2.0 ↗. Reproduced here unmodified. 
AnalysisType: correlation_rule
RuleID: "AWS.EC2.StopInstance.WITH.ModifyInstanceAttributes"
DisplayName: "StopInstance WITH ModifyInstanceAttributes"
Enabled: false
Severity: High
Description: Identifies when StopInstance and ModifyInstanceAttributes CloudTrail events occur in a short period of time. Since EC2 startup scripts cannot be modified without first stopping the instance, StopInstances should be a signal.
Reference: https://unit42.paloaltonetworks.com/malicious-operations-of-exposed-iam-keys-cryptojacking/
Reports:
  MITRE ATT&CK:
    - TA0002:T1059
Detection:
    - Group:
        - ID: StopInstance
          RuleID: AWS.EC2.StopInstances
        - ID: StartupScriptChange
          RuleID: AWS.EC2.Startup.Script.Change
      MatchCriteria:
        field_name:
          - GroupID: StopInstance
            Match: p_alert_context.instance_ids
          - GroupID: StartupScriptChange
            Match: p_alert_context.instance_ids
      LookbackWindowMinutes: 1800
      Schedule:
        RateMinutes: 1440
        TimeoutMinutes: 5
Tests:
    - Name: Instance Stopped, Followed By Script Change
      ExpectedResult: true
      RuleOutputs:
        - ID: StopInstance
          Matches:
            p_alert_context.instance_ids:
              'i-abcdef0123456789a':
                - "2024-06-01T10:00:01Z"
        - ID: StartupScriptChange
          Matches:
            p_alert_context.instance_ids:
              'i-abcdef0123456789a':
                - "2024-06-01T10:01:01Z"
    - Name: Instance Stopped, Not Followed By Script Change
      ExpectedResult: false
      RuleOutputs:
        - ID: StopInstance
          Matches:
            p_alert_context.instance_ids:
              'i-abcdef0123456789a':
                - "2024-06-01T10:00:01Z"

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.