huntrule

AWS CloudTrail CreateRoute: New Network Route Added to Route Table

Flags CloudTrail EC2 CreateRoute events indicating a new route was added to an AWS route table.

FreeUnreviewedSigmamediumv1
title: "AWS CloudTrail CreateRoute: New Network Route Added to Route Table"
id: 0c2395ec-cda5-4a11-a9b6-7217f052fc77
status: test
description: This rule matches AWS CloudTrail events where the EC2 API action CreateRoute adds a new route to a route table. Attackers may use route changes to redirect or expose traffic by altering how network packets are forwarded. Detection relies on CloudTrail records capturing eventSource ec2.amazonaws.com and eventName CreateRoute.
references:
  - https://www.gorillastack.com/blog/real-time-events/important-aws-cloudtrail-security-events-tracking/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/aws/cloudtrail/aws_cloudtrail_new_route_added.yml
author: jamesc-grafana, Huntrule Team
date: 2024-07-11
tags:
  - attack.defense-impairment
  - attack.t1686.001
logsource:
  product: aws
  service: cloudtrail
detection:
  selection:
    eventSource: ec2.amazonaws.com
    eventName: CreateRoute
  condition: selection
falsepositives:
  - New VPC Creation requiring setup of a new route table
  - New subnets added requiring routing setup
level: medium
license: DRL-1.1
related:
  - id: c803b2ce-c4a2-4836-beae-b112010390b1
    type: derived

What it detects

This rule matches AWS CloudTrail events where the EC2 API action CreateRoute adds a new route to a route table. Attackers may use route changes to redirect or expose traffic by altering how network packets are forwarded. Detection relies on CloudTrail records capturing eventSource ec2.amazonaws.com and eventName CreateRoute.

Known false positives

  • New VPC Creation requiring setup of a new route table
  • New subnets added requiring routing setup

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.