ID | Technique | Tactic |
---|---|---|
T1562.007 | Disable or Modify Cloud Firewall | Defense Evasion |
T1562 | Impair Defenses | Defense Evasion |
Detection: AWS Network Access Control List Created with All Open Ports
Description
The following analytic detects the creation of AWS Network Access Control Lists (ACLs) with all ports open to a specified CIDR. It leverages AWS CloudTrail events, specifically monitoring for CreateNetworkAclEntry
or ReplaceNetworkAclEntry
actions with rules allowing all traffic. This activity is significant because it can expose the network to unauthorized access, increasing the risk of data breaches and other malicious activities. If confirmed malicious, an attacker could exploit this misconfiguration to gain unrestricted access to the network, potentially leading to data exfiltration, service disruption, or further compromise of the AWS environment.
Search
1`cloudtrail` eventName=CreateNetworkAclEntry OR eventName=ReplaceNetworkAclEntry requestParameters.ruleAction=allow requestParameters.egress=false requestParameters.aclProtocol=-1
2| append [search `cloudtrail` eventName=CreateNetworkAclEntry OR eventName=ReplaceNetworkAclEntry requestParameters.ruleAction=allow requestParameters.egress=false requestParameters.aclProtocol!=-1
3| eval port_range='requestParameters.portRange.to' - 'requestParameters.portRange.from'
4| where port_range>1024]
5| fillnull
6| stats count min(_time) as firstTime max(_time) as lastTime by userName user_arn userIdentity.principalId eventName requestParameters.ruleAction requestParameters.egress requestParameters.aclProtocol requestParameters.portRange.to requestParameters.portRange.from src userAgent requestParameters.cidrBlock
7| `security_content_ctime(firstTime)`
8| `security_content_ctime(lastTime)`
9| `aws_network_access_control_list_created_with_all_open_ports_filter`
Data Source
Name | Platform | Sourcetype | Source | Supported App |
---|---|---|---|---|
AWS CloudTrail CreateNetworkAclEntry | AWS | 'aws:cloudtrail' |
'aws_cloudtrail' |
N/A |
Macros Used
Name | Value |
---|---|
cloudtrail | sourcetype=aws:cloudtrail |
aws_network_access_control_list_created_with_all_open_ports_filter | search * |
aws_network_access_control_list_created_with_all_open_ports_filter
is an empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
Annotations
Default Configuration
This detection is configured by default in Splunk Enterprise Security to run with the following settings:
Setting | Value |
---|---|
Disabled | true |
Cron Schedule | 0 * * * * |
Earliest Time | -70m@m |
Latest Time | -10m@m |
Schedule Window | auto |
Creates Notable | Yes |
Rule Title | %name% |
Rule Description | %description% |
Notable Event Fields | user, dest |
Creates Risk Event | True |
Implementation
You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS, version 4.4.0 or later, and configure your AWS CloudTrail inputs.
Known False Positives
It's possible that an admin has created this ACL with all ports open for some legitimate purpose however, this should be scoped and not allowed in production environment.
Associated Analytic Story
Risk Based Analytics (RBA)
Risk Message | Risk Score | Impact | Confidence |
---|---|---|---|
User $user_arn$ has created network ACLs with all the ports open to a specified CIDR $requestParameters.cidrBlock$ | 48 | 60 | 80 |
Detection Testing
Test Type | Status | Dataset | Source | Sourcetype |
---|---|---|---|---|
Validation | ✅ Passing | N/A | N/A | N/A |
Unit | ✅ Passing | Dataset | aws_cloudtrail |
aws:cloudtrail |
Integration | ✅ Passing | Dataset | aws_cloudtrail |
aws:cloudtrail |
Replay any dataset to Splunk Enterprise by using our replay.py
tool or the UI.
Alternatively you can replay a dataset into a Splunk Attack Range
Source: GitHub | Version: 3