Skip to content
Threat Feed

Tag

User-Data

1 brief RSS
high advisory

AWS EC2 Stop, Start, and User Data Modification Correlation

Detection of a sequence of AWS EC2 management API calls indicative of malicious modification of instance user data to execute arbitrary code upon instance restart, potentially leading to privilege escalation and persistence.

EC2 aws user-data privilege-escalation persistence execution
3r 2t