AWS CloudTrail: CreateNetworkAclEntry Adds Network ACL Rules
Identifies when EC2 network ACL entries are created in AWS via CloudTrail.
FreeReviewedSigma · Low · v5
- Product
- aws
- Service
- cloudtrail
- Author
- jamesc-grafana (SigmaHQ), DRL 1.1
- Published
- 2024-07-11
- Updated
- 2026-07-31
ATT&CK techniques
Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies AWS CloudTrail events where a new network ACL entry is created (CreateNetworkAclEntry) for EC2. Adding ACL rules can broaden network reachability and potentially open new paths for inbound or outbound traffic, making it important for spotting configuration changes. It relies on CloudTrail telemetry recording EC2 API calls with event source and event name.
Reporting behind it
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
aws-cloudtrail-detect-createnetworkaclentry-new-network-acl-rule-added-e1f7febb
title: "AWS CloudTrail: CreateNetworkAclEntry Adds Network ACL Rules"
id: d880a7f1-11d8-416a-95cf-6928f1212809
status: test
description: This rule identifies AWS CloudTrail events where a new network ACL entry is created (CreateNetworkAclEntry) for EC2. Adding ACL rules can broaden network reachability and potentially open new paths for inbound or outbound traffic, making it important for spotting configuration changes. It relies on CloudTrail telemetry recording EC2 API calls with event source and event name.
references:
- https://www.gorillastack.com/blog/real-time-events/important-aws-cloudtrail-security-events-tracking/
- https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/aws/cloudtrail/aws_cloudtrail_new_acl_entries.yml
author: jamesc-grafana, Huntrule Team
date: 2024-07-11
tags:
- attack.defense-impairment
- attack.t1686.001
logsource:
product: aws
service: cloudtrail
detection:
selection:
eventSource: ec2.amazonaws.com
eventName: CreateNetworkAclEntry
condition: selection
falsepositives:
- Legitimate use of ACLs to enable customer and staff access from the public internet into a public VPC
level: low
license: DRL-1.1
related:
- id: e1f7febb-7b94-4234-b5c6-00fb8500f5dd
type: derived