aws_ec2_modifications.yml

category:
  - Cloud Security
channel: ESCU
creation_date: '2018-04-09'
description: Identify unusual changes to your AWS EC2 instances that may indicate
  malicious activity. Modifications to your EC2 instances by previously unseen users
  is an example of an activity that may warrant further investigation.
detections:
  - detection_id: 56f91724-cf3f-4666-84e1-e3712fb41e76
    name: EC2 Instance Modified With Previously Unseen User
    type: splunk
id: 73de57ef-0dfc-411f-b1e7-fa24428aeae0
maintainers:
  - company: Splunk
    email: davidd@splunk.com
    name: David Dorsey
modification_date: '2018-04-09'
name: Unusual AWS EC2 Modifications
narrative: "A common attack technique is to infiltrate a cloud instance and make modifications.\
  \ The adversary can then secure access to your infrastructure or hide their activities.\
  \ So it's important to stay alert to changes that may indicate that your environment\
  \ has been compromised. \\\n Searches within this Analytic Story can help you detect\
  \ the presence of a threat by monitoring for EC2 instances that have been created\
  \ or changed--either by users that have never previously performed these activities\
  \ or by known users who modify or create instances in a way that have not been done\
  \ before. This story also provides investigative searches that help you go deeper\
  \ once you detect suspicious behavior."
original_authors:
  - company: Splunk
    email: davidd@splunk.com
    name: David Dorsey
references:
  - https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf
spec_version: 2
usecase: Security Monitoring
version: '1.0'