AWS CloudTrail: ELB/ALB Security Group Changes via ApplySecurityGroupsToLoadBalancer or SetSecurityGroups

Alerts on CloudTrail events that change ELB/ALB security groups by applying or setting load balancer security groups.

FreeUnreviewedSigmamediumv1

aws-cloudtrail-elb-alb-security-group-changes-via-applysecuritygroupstoloadbalan-7a4409fc

title: "AWS CloudTrail: ELB/ALB Security Group Changes via ApplySecurityGroupsToLoadBalancer or SetSecurityGroups"
id: 4dd54c6d-e31f-4d93-8760-f87144eaf1bc
status: test
description: This rule identifies AWS CloudTrail events where security groups are applied to or set for an Elastic Load Balancer (ELB) or Application Load Balancer (ALB). Attackers may modify load balancer network access to permit new inbound connections into VPC or subnet resources. The detection relies on CloudTrail telemetry for the elasticloadbalancing.amazonaws.com eventSource and the specific API actions ApplySecurityGroupsToLoadBalancer and SetSecurityGroups.
references:
  - https://www.gorillastack.com/blog/real-time-events/important-aws-cloudtrail-security-events-tracking/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/aws/cloudtrail/aws_cloudtrail_security_group_change_loadbalancer.yml
author: jamesc-grafana, Huntrule Team
date: 2024-07-11
tags:
  - attack.initial-access
  - attack.t1190
logsource:
  product: aws
  service: cloudtrail
detection:
  selection:
    eventSource: elasticloadbalancing.amazonaws.com
    eventName:
      - ApplySecurityGroupsToLoadBalancer
      - SetSecurityGroups
  condition: selection
falsepositives:
  - Repurposing of an ELB or ALB to serve a different or additional application
  - Changes to security groups to allow for new services to be deployed
level: medium
license: DRL-1.1
related:
  - id: 7a4409fc-f8ca-45f6-8006-127d779eaad9
    type: derived

What it detects

This rule identifies AWS CloudTrail events where security groups are applied to or set for an Elastic Load Balancer (ELB) or Application Load Balancer (ALB). Attackers may modify load balancer network access to permit new inbound connections into VPC or subnet resources. The detection relies on CloudTrail telemetry for the elasticloadbalancing.amazonaws.com eventSource and the specific API actions ApplySecurityGroupsToLoadBalancer and SetSecurityGroups.

Known false positives

Repurposing of an ELB or ALB to serve a different or additional application
Changes to security groups to allow for new services to be deployed

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.