This rule flags a potentially malicious or unintended change to EC2 startup behavior by monitoring a specific two-step CloudTrail sequence. It detects when an IAM principal stops an EC2 instance (StopInstances) and, within one hour, issues a ModifyInstanceAttribute request targeting the instance’s userData on the same EC2, implying an attempt to alter startup behavior or establish persistence. The CloudTrail-based detection does not confirm execution of the modified user-data script; it only identifies the correlation between the stop event and a later userData modification. The detection extracts the IAM principal (userIdentity.arn), resolves the affected instance_id from both events, ensures both events succeeded, filters for the userData modification event, computes the elapsed time between stop and modification, and emits a finding containing the principal, instance, stop time, modification time, and the elapsed window. The rule maps to MITRE ATT&CK technique T1578.005 and is designed for Splunk deployments using AWS CloudTrail logs. The accompanying finding title is: The IAM principal [$user_arn$] modified user data on stopped EC2 instance [$instance_id$].