How Identifying UserData Script Manipulation Accelerates Investigation

This report explains how threat actors can manipulate EC2 UserData to run arbitrary scripts on instances—allowing immediate code execution, persistence, malware deployment, and exfiltration of instance IAM credentials via the metadata service. It details attack sequences (e.g., stop-modify-start), demonstrates credential exfiltration to an attacker-owned S3 bucket, highlights detection challenges with CloudTrail (which does not expose modified user data contents), and recommends monitoring and automated forensic approaches (including Mitiga IR² detections) to identify and investigate such abuse.