huntrule

AWS CloudTrail Security Group Ingress/Egress Rule Changes

Alerts on AWS security group ingress/egress rule authorizations or revocations seen in CloudTrail EC2 events.

FreeReviewedSigma · Medium · v5
Product
aws
Service
cloudtrail
Author
jamesc-grafana (SigmaHQ), DRL 1.1
Published
2024-07-11
Updated
2026-07-31
AnalysisDetection
title: AWS CloudTrail Security Group Ingress/Egress Rule Changes
id: e6365011-e476-4d14-a1cc-2005abac2a45
status: test
description: This rule identifies CloudTrail events where security group ingress or egress rules are authorized or revoked. Such changes can enable new inbound access paths, permit outbound communication for data exfiltration, or allow instances to reach untrusted command-and-control infrastructure. It relies on AWS CloudTrail telemetry from EC2 with matching event sources and event names for security group rule modifications.
references:
  - https://www.gorillastack.com/blog/real-time-events/important-aws-cloudtrail-security-events-tracking/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/aws/cloudtrail/aws_cloudtrail_security_group_change_ingress_egress.yml
author: jamesc-grafana, Huntrule Team
date: 2024-07-11
tags:
  - attack.initial-access
  - attack.t1190
logsource:
  product: aws
  service: cloudtrail
detection:
  selection:
    eventSource: ec2.amazonaws.com
    eventName:
      - AuthorizeSecurityGroupEgress
      - AuthorizeSecurityGroupIngress
      - RevokeSecurityGroupEgress
      - RevokeSecurityGroupIngress
  condition: selection
falsepositives:
  - New VPCs and Subnets being setup requiring a different security profile to those already defined
  - A single port being opened for a new service that is known to be deploying
  - Administrators closing unused ports to reduce the attack surface
level: medium
license: DRL-1.1
related:
  - id: 6fb77778-040f-4015-9440-572aa9b6b580
    type: derived