Try in Splunk Security Cloud

Description

The search looks for AWS CloudTrail events to detect if any network ACLs were created with all the ports open to a specified CIDR.

  • Type: TTP
  • Product: Splunk Security Analytics for AWS, Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
  • Datamodel:
  • Last Updated: 2021-01-11
  • Author: Bhavin Patel, Patrick Bareiss, Splunk
  • ID: ada0f478-84a8-4641-a3f1-d82362d6bd75

ATT&CK

ID Technique Tactic
T1562.007 Disable or Modify Cloud Firewall Defense Evasion
`cloudtrail` eventName=CreateNetworkAclEntry OR eventName=ReplaceNetworkAclEntry requestParameters.ruleAction=allow requestParameters.egress=false requestParameters.aclProtocol=-1 
| append [search `cloudtrail` eventName=CreateNetworkAclEntry OR eventName=ReplaceNetworkAclEntry requestParameters.ruleAction=allow requestParameters.egress=false requestParameters.aclProtocol!=-1 
| eval port_range='requestParameters.portRange.to' - 'requestParameters.portRange.from' 
| where port_range>1024] 
| fillnull 
| stats count min(_time) as firstTime max(_time) as lastTime by userName userIdentity.principalId eventName requestParameters.ruleAction requestParameters.egress requestParameters.aclProtocol requestParameters.portRange.to requestParameters.portRange.from src userAgent requestParameters.cidrBlock 
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)` 
| `aws_network_access_control_list_created_with_all_open_ports_filter`

Associated Analytic Story

How To Implement

You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS, version 4.4.0 or later, and configure your AWS CloudTrail inputs.

Required field

  • _time
  • eventName
  • requestParameters.ruleAction
  • requestParameters.egress
  • requestParameters.aclProtocol
  • requestParameters.portRange.to
  • requestParameters.portRange.from
  • requestParameters.cidrBlock
  • userName
  • userIdentity.principalId
  • userAgent

Kill Chain Phase

  • Actions on Objectives

Known False Positives

It's possible that an admin has created this ACL with all ports open for some legitimate purpose however, this should be scoped and not allowed in production environment.

RBA

Risk Score Impact Confidence Message
48.0 60 80 User $user_arn$ has created network ACLs with all the ports open to a specified CIDR $requestParameters.cidrBlock$

Reference

Test Dataset

Replay any dataset to Splunk Enterprise by using our replay.py tool or the UI. Alternatively you can replay a dataset into a Splunk Attack Range

source | version: 2