AWS network ACL modified
A VPC network ACL or its entries were created, replaced or deleted.
What it detects
A VPC network ACL or its entries were created, replaced or deleted.
Network ACLs are the subnet-level firewall. Editing them is how an attacker opens a path for a reverse shell or a data pull, and how they remove a rule that was blocking one — both are changes to the boundary itself rather than to a workload, which is why they are worth reading even when routine.
MITRE ATT&CK mapping
- T1562.007Impair Defenses: Disable or Modify Cloud Firewall· Defense Evasion
False positives and triage
Network configuration is managed by infrastructure-as-code in most estates, so expect these in bulk during a deployment and attribute them to the deploying role. The signal is a change by a human IAM user, an entry that allows 0.0.0.0/0 on a management port, a rule deletion with no corresponding create, or a change in a region the account does not normally operate in.
The rule
Declarative YAML read by the detection engine — data, never executed. Confidence 60%. Source: rules/cloud/aws_network_acl_modified.yaml, licensed under the Apache License 2.0.
id: cloud.aws.network_acl_modified
version: 1.0.0
status: stable
severity: medium
confidence: 0.6
platforms: [application]
mitre_techniques: [T1562.007]
description: |
A VPC network ACL or its entries were created, replaced or deleted.
Network ACLs are the subnet-level firewall. Editing them is how an attacker opens
a path for a reverse shell or a data pull, and how they remove a rule that was
blocking one — both are changes to the boundary itself rather than to a workload,
which is why they are worth reading even when routine.
match:
provider: AWS
event_action_any:
- CreateNetworkAcl
- CreateNetworkAclEntry
- DeleteNetworkAcl
- DeleteNetworkAclEntry
- ReplaceNetworkAclEntry
- ReplaceNetworkAclAssociation
correlation_keys: [user_name]
false_positive_guidance: |
Network configuration is managed by infrastructure-as-code in most estates, so
expect these in bulk during a deployment and attribute them to the deploying role.
The signal is a change by a human IAM user, an entry that allows 0.0.0.0/0 on a
management port, a rule deletion with no corresponding create, or a change in a
region the account does not normally operate in.
Related detections
Run this rule on your own logs — offline
KIROSEC runs this rule and the rest of the library over Windows, Linux, macOS and cloud audit logs on the analyst's own machine. Every alert links to the events that raised it, and nothing leaves the device.