AWS CloudTrail Security Group Ingress/Egress Rule Changes
Alerts on AWS security group ingress/egress rule authorizations or revocations seen in CloudTrail EC2 events.
- Product
- aws
- Service
- cloudtrail
- Author
- jamesc-grafana (SigmaHQ), DRL 1.1
- Published
- 2024-07-11
- Updated
- 2026-07-31
ATT&CK techniques
Initial AccessRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies CloudTrail events where security group ingress or egress rules are authorized or revoked. Such changes can enable new inbound access paths, permit outbound communication for data exfiltration, or allow instances to reach untrusted command-and-control infrastructure. It relies on AWS CloudTrail telemetry from EC2 with matching event sources and event names for security group rule modifications.
Reporting behind it
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: AWS CloudTrail Security Group Ingress/Egress Rule Changes
id: e6365011-e476-4d14-a1cc-2005abac2a45
status: test
description: This rule identifies CloudTrail events where security group ingress or egress rules are authorized or revoked. Such changes can enable new inbound access paths, permit outbound communication for data exfiltration, or allow instances to reach untrusted command-and-control infrastructure. It relies on AWS CloudTrail telemetry from EC2 with matching event sources and event names for security group rule modifications.
references:
- https://www.gorillastack.com/blog/real-time-events/important-aws-cloudtrail-security-events-tracking/
- https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/aws/cloudtrail/aws_cloudtrail_security_group_change_ingress_egress.yml
author: jamesc-grafana, Huntrule Team
date: 2024-07-11
tags:
- attack.initial-access
- attack.t1190
logsource:
product: aws
service: cloudtrail
detection:
selection:
eventSource: ec2.amazonaws.com
eventName:
- AuthorizeSecurityGroupEgress
- AuthorizeSecurityGroupIngress
- RevokeSecurityGroupEgress
- RevokeSecurityGroupIngress
condition: selection
falsepositives:
- New VPCs and Subnets being setup requiring a different security profile to those already defined
- A single port being opened for a new service that is known to be deploying
- Administrators closing unused ports to reduce the attack surface
level: medium
license: DRL-1.1
related:
- id: 6fb77778-040f-4015-9440-572aa9b6b580
type: derived