AWS CloudTrail: Security Group Ingress/Egress Rule Changes

Alerts on AWS security group ingress/egress rule authorizations or revocations seen in CloudTrail EC2 events.

FreeUnreviewedSigmamediumv1

aws-cloudtrail-security-group-ingress-egress-rule-changes-6fb77778

title: "AWS CloudTrail: Security Group Ingress/Egress Rule Changes"
id: e6365011-e476-4d14-a1cc-2005abac2a45
status: test
description: "This rule flags CloudTrail events where an AWS principal modifies a security group’s network access by authorizing or revoking ingress or egress rules. Such changes can allow new inbound or outbound connectivity, potentially enabling data exfiltration, new attack paths, or communication with unwanted external services. It relies on CloudTrail telemetry for EC2 events: AuthorizeSecurityGroupIngress/Egress and RevokeSecurityGroupIngress/Egress."
references:
  - https://www.gorillastack.com/blog/real-time-events/important-aws-cloudtrail-security-events-tracking/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/aws/cloudtrail/aws_cloudtrail_security_group_change_ingress_egress.yml
author: jamesc-grafana, Huntrule Team
date: 2024-07-11
tags:
  - attack.initial-access
  - attack.t1190
logsource:
  product: aws
  service: cloudtrail
detection:
  selection:
    eventSource: ec2.amazonaws.com
    eventName:
      - AuthorizeSecurityGroupEgress
      - AuthorizeSecurityGroupIngress
      - RevokeSecurityGroupEgress
      - RevokeSecurityGroupIngress
  condition: selection
falsepositives:
  - New VPCs and Subnets being setup requiring a different security profile to those already defined
  - A single port being opened for a new service that is known to be deploying
  - Administrators closing unused ports to reduce the attack surface
level: medium
license: DRL-1.1
related:
  - id: 6fb77778-040f-4015-9440-572aa9b6b580
    type: derived

What it detects

This rule flags CloudTrail events where an AWS principal modifies a security group’s network access by authorizing or revoking ingress or egress rules. Such changes can allow new inbound or outbound connectivity, potentially enabling data exfiltration, new attack paths, or communication with unwanted external services. It relies on CloudTrail telemetry for EC2 events: AuthorizeSecurityGroupIngress/Egress and RevokeSecurityGroupIngress/Egress.

Known false positives

New VPCs and Subnets being setup requiring a different security profile to those already defined
A single port being opened for a new service that is known to be deploying
Administrators closing unused ports to reduce the attack surface

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.