huntrule

AWS CloudTrail ELB/ALB Security Group Changes via ApplySecurityGroupsToLoadBalancer or SetSecurityGroups

Alerts on CloudTrail events that change ELB/ALB security groups by applying or setting load balancer security groups.

FreeReviewedSigma · Medium · v5
Product
aws
Service
cloudtrail
Author
jamesc-grafana (SigmaHQ), DRL 1.1
Published
2024-07-11
Updated
2026-07-31
AnalysisDetection
title: AWS CloudTrail ELB/ALB Security Group Changes via ApplySecurityGroupsToLoadBalancer or SetSecurityGroups
id: 4dd54c6d-e31f-4d93-8760-f87144eaf1bc
status: test
description: This rule flags CloudTrail events where an Elastic Load Balancer (ELB) or Application Load Balancer (ALB) has its attached security groups modified using ApplySecurityGroupsToLoadBalancer or SetSecurityGroups. Changing load balancer security groups can expand or alter inbound network access, which may reflect misconfiguration or an attacker adjusting connectivity into VPC/subnet resources. Detection relies on CloudTrail telemetry with eventSource elasticloadbalancing.amazonaws.com and the specific eventName values.
references:
  - https://www.gorillastack.com/blog/real-time-events/important-aws-cloudtrail-security-events-tracking/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/aws/cloudtrail/aws_cloudtrail_security_group_change_loadbalancer.yml
author: jamesc-grafana, Huntrule Team
date: 2024-07-11
tags:
  - attack.initial-access
  - attack.t1190
logsource:
  product: aws
  service: cloudtrail
detection:
  selection:
    eventSource: elasticloadbalancing.amazonaws.com
    eventName:
      - ApplySecurityGroupsToLoadBalancer
      - SetSecurityGroups
  condition: selection
falsepositives:
  - Repurposing of an ELB or ALB to serve a different or additional application
  - Changes to security groups to allow for new services to be deployed
level: medium
license: DRL-1.1
related:
  - id: 7a4409fc-f8ca-45f6-8006-127d779eaad9
    type: derived