relationship_id: REL-2022-0117
name: User modified Instance
contributors:
- Jose Rodriguez @Cyb3rPandaH
attack:
  data_source: instance
  data_component: instance modification
behavior:
  source: user
  relationship: modified
  target: instance
security_events:
- event_id: cloudtrail
  name: cloudtrail
  platform: aws
  log_source: cloudtrail
  filter_in:
  - eventName: ModifyInstanceAttribute
  - eventType: AwsApiCall
  event_version:
  - '1.05'
references: null
notes: null