Suspicious Ingress/Egress Security Group Change (via cloudtrail)

title: Suspicious Ingress/Egress Security Group Change (via cloudtrail)
id: 1afbb93b-5493-5696-bd97-04a4085961ed
status: stable
description: This rule detects when an account makes changes to the ingress or egress rules of a security group. This can indicate that an adversary is attempting to open up new attack vectors in the account, that they are trying to exfiltrate data over the network, or that they are trying to enable machines in that VPC/Subnet to contact a C&C server.
references:
    - https://attack.mitre.org/techniques/T1190/
    - https://www.gorillastack.com/blog/real-time-events/important-aws-cloudtrail-security-events-tracking/
author: Huntrule Team
date: 2026-07-28
tags:
    - attack.initial-access
    - attack.t1190
logsource:
    product: aws
    service: cloudtrail
detection:
    selection:
        eventSource: 'ec2.amazonaws.com'
        eventName:
            - 'AuthorizeSecurityGroupEgress'
            - 'AuthorizeSecurityGroupIngress'
            - 'RevokeSecurityGroupEgress'
            - 'RevokeSecurityGroupIngress'
    condition: selection
falsepositives:
    - Unknown
level: medium