AWS CloudTrail Security Group Ingress/Egress Rule Changes

Alerts on AWS security group ingress/egress rule authorizations or revocations seen in CloudTrail EC2 events.

FreeReviewedSigma · Medium · v5

Product: aws
Service: cloudtrail
Author: jamesc-grafana (SigmaHQ), DRL 1.1
Published: 2024-07-11
Updated: 2026-07-31

ATT&CK techniques

Initial Access

Recon
Resource Dev
Initial Access
- T1190Exploit Public-Facing Application
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule identifies CloudTrail events where security group ingress or egress rules are authorized or revoked. Such changes can enable new inbound access paths, permit outbound communication for data exfiltration, or allow instances to reach untrusted command-and-control infrastructure. It relies on AWS CloudTrail telemetry from EC2 with matching event sources and event names for security group rule modifications.

Reporting behind it

Related detections9 linkedT1190 — drag to rearrange

Malicious SharePoint ToolShell Post-Exploitation via Encoded PowerShell (via process_creation)

Malicious Web Shell Written to SharePoint LAYOUTS Directory by Worker Process (via file_event)

Malicious MS-SQL Server Spawning Command Shell via Mallox

Malicious ActiveMQ CVE-2023-46604 Payload Download via curl or wget

Malicious WordPress Core SQL Injection Scanner via User-Agent

Malicious Command Shell Spawned by SQL Server via Process Creation (via process_creation)

Malicious Command Shell or PowerShell Spawned by Tomcat via Process Creation (via process_creation)

Suspicious Shell Script Execution From Temp Directory on SonicWall SMA1000 Appliance (via process_creation)

Possible TP-Link Command Injection via WlanNetworkRpm Endpoint (via webserver)

AWS CloudTrail Security Group Ingress/Egress Rule Changes

Pivot detection · T1190 · 9 related

Changelog

v5
Candidate ingested via manual entry.2026-07-31
v4
Candidate ingested via manual entry.2026-07-31
v3
Candidate ingested via manual entry.2026-07-31
v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

aws-cloudtrail-security-group-ingress-egress-rule-changes-6fb77778

title: AWS CloudTrail Security Group Ingress/Egress Rule Changes
id: e6365011-e476-4d14-a1cc-2005abac2a45
status: test
description: This rule identifies CloudTrail events where security group ingress or egress rules are authorized or revoked. Such changes can enable new inbound access paths, permit outbound communication for data exfiltration, or allow instances to reach untrusted command-and-control infrastructure. It relies on AWS CloudTrail telemetry from EC2 with matching event sources and event names for security group rule modifications.
references:
  - https://www.gorillastack.com/blog/real-time-events/important-aws-cloudtrail-security-events-tracking/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/aws/cloudtrail/aws_cloudtrail_security_group_change_ingress_egress.yml
author: jamesc-grafana, Huntrule Team
date: 2024-07-11
tags:
  - attack.initial-access
  - attack.t1190
logsource:
  product: aws
  service: cloudtrail
detection:
  selection:
    eventSource: ec2.amazonaws.com
    eventName:
      - AuthorizeSecurityGroupEgress
      - AuthorizeSecurityGroupIngress
      - RevokeSecurityGroupEgress
      - RevokeSecurityGroupIngress
  condition: selection
falsepositives:
  - New VPCs and Subnets being setup requiring a different security profile to those already defined
  - A single port being opened for a new service that is known to be deploying
  - Administrators closing unused ports to reduce the attack surface
level: medium
license: DRL-1.1
related:
  - id: 6fb77778-040f-4015-9440-572aa9b6b580
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL