Suspicious LoadBalancer Security Group Change (via cloudtrail)

title: Suspicious LoadBalancer Security Group Change (via cloudtrail)
id: b43d40f4-3ccc-5679-b110-19551a178b95
status: stable
description: This rule detects changes to the security groups linked with an Elastic Load Balancer (ELB) or Application Load Balancer (ALB). This can indicate that a misconfiguration allowing more traffic into the system than required, or could indicate that an adversary is attempting to enable new connections into a VPC or subnet controlled by the account.
references:
    - https://attack.mitre.org/techniques/T1190/
    - https://www.gorillastack.com/blog/real-time-events/important-aws-cloudtrail-security-events-tracking/
author: Huntrule Team
date: 2026-04-30
tags:
    - attack.initial-access
    - attack.t1190
logsource:
    product: aws
    service: cloudtrail
detection:
    selection:
        eventSource: 'elasticloadbalancing.amazonaws.com'
        eventName:
            - 'ApplySecurityGroupsToLoadBalancer'
            - 'SetSecurityGroups'
    condition: selection
falsepositives:
    - Unknown
level: medium