AWS CloudTrail: CreateRoute Adds New Network Route to a Route Table
Flags CloudTrail EC2 CreateRoute events indicating a new route was added to an AWS route table.
- Product
- aws
- Service
- cloudtrail
- Author
- jamesc-grafana (SigmaHQ), DRL 1.1
- Published
- 2024-07-11
- Updated
- 2026-07-31
ATT&CK techniques
Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule alerts when an EC2 CreateRoute API call is made, indicating that a new network route was added to a route table. Attackers can abuse routing changes to redirect traffic, enable access to otherwise unreachable networks, or impair network visibility. The detection relies on AWS CloudTrail event fields for eventSource ec2.amazonaws.com and eventName CreateRoute.
Reporting behind it
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "AWS CloudTrail: CreateRoute Adds New Network Route to a Route Table"
id: 0c2395ec-cda5-4a11-a9b6-7217f052fc77
status: test
description: This rule alerts when an EC2 CreateRoute API call is made, indicating that a new network route was added to a route table. Attackers can abuse routing changes to redirect traffic, enable access to otherwise unreachable networks, or impair network visibility. The detection relies on AWS CloudTrail event fields for eventSource ec2.amazonaws.com and eventName CreateRoute.
references:
- https://www.gorillastack.com/blog/real-time-events/important-aws-cloudtrail-security-events-tracking/
- https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/aws/cloudtrail/aws_cloudtrail_new_route_added.yml
author: jamesc-grafana, Huntrule Team
date: 2024-07-11
tags:
- attack.defense-impairment
- attack.t1686.001
logsource:
product: aws
service: cloudtrail
detection:
selection:
eventSource: ec2.amazonaws.com
eventName: CreateRoute
condition: selection
falsepositives:
- New VPC Creation requiring setup of a new route table
- New subnets added requiring routing setup
level: medium
license: DRL-1.1
related:
- id: c803b2ce-c4a2-4836-beae-b112010390b1
type: derived