Glossary term
Startup script (Compute Engine)
A Compute Engine metadata value (startup-script, startup-script-url) that runs as root on Linux at every boot. Changing it is a persistence technique.
A startup script is code stored in Compute Engine instance or project metadata under keys such as startup-script or startup-script-url (Windows uses windows-startup-script-ps1 and similar). On Linux, the guest environment runs it as root at every boot.
Anyone allowed to set instance metadata, or project-wide common metadata, can therefore run code as root on VMs at the next reboot. In audit logs the change appears as v1.compute.instances.setMetadata or v1.compute.projects.setCommonInstanceMetadata, with the metadata keys added, modified or deleted in the metadata delta; the script itself has to be read from the VM or project metadata.
See GCP crypto mining and startup-script backdoors: detection.