AWS CloudTrail: Detect CreateNetworkAclEntry (New Network ACL Rule Added)

Identifies when EC2 network ACL entries are created in AWS via CloudTrail.

FreeUnreviewedSigmalowv1

aws-cloudtrail-detect-createnetworkaclentry-new-network-acl-rule-added-e1f7febb

title: "AWS CloudTrail: Detect CreateNetworkAclEntry (New Network ACL Rule Added)"
id: d880a7f1-11d8-416a-95cf-6928f1212809
status: test
description: This rule flags CloudTrail events where an EC2 network ACL entry is created via CreateNetworkAclEntry. Adding ACL entries can change allowed or denied traffic flows, which may open new network paths for an attacker if done unexpectedly. It relies on AWS CloudTrail telemetry capturing eventSource and eventName for the CreateNetworkAclEntry action.
references:
  - https://www.gorillastack.com/blog/real-time-events/important-aws-cloudtrail-security-events-tracking/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/aws/cloudtrail/aws_cloudtrail_new_acl_entries.yml
author: jamesc-grafana, Huntrule Team
date: 2024-07-11
tags:
  - attack.defense-impairment
  - attack.t1686.001
logsource:
  product: aws
  service: cloudtrail
detection:
  selection:
    eventSource: ec2.amazonaws.com
    eventName: CreateNetworkAclEntry
  condition: selection
falsepositives:
  - Legitimate use of ACLs to enable customer and staff access from the public internet into a public VPC
level: low
license: DRL-1.1
related:
  - id: e1f7febb-7b94-4234-b5c6-00fb8500f5dd
    type: derived

What it detects

This rule flags CloudTrail events where an EC2 network ACL entry is created via CreateNetworkAclEntry. Adding ACL entries can change allowed or denied traffic flows, which may open new network paths for an attacker if done unexpectedly. It relies on AWS CloudTrail telemetry capturing eventSource and eventName for the CreateNetworkAclEntry action.

Known false positives

Legitimate use of ACLs to enable customer and staff access from the public internet into a public VPC

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.