Detection: AWS Network Access Control List Created with All Open Ports

Updated Date: 2024-05-14 ID: ada0f478-84a8-4641-a3f1-d82362d6bd75 Author: Bhavin Patel, Patrick Bareiss, Splunk Type: TTP Product: Splunk Enterprise Security

Description

The following analytic detects the creation of AWS Network Access Control Lists (ACLs) with all ports open to a specified CIDR. It leverages AWS CloudTrail events, specifically monitoring for CreateNetworkAclEntry or ReplaceNetworkAclEntry actions with rules allowing all traffic. This activity is significant because it can expose the network to unauthorized access, increasing the risk of data breaches and other malicious activities. If confirmed malicious, an attacker could exploit this misconfiguration to gain unrestricted access to the network, potentially leading to data exfiltration, service disruption, or further compromise of the AWS environment.

Search

1`cloudtrail` eventName=CreateNetworkAclEntry OR eventName=ReplaceNetworkAclEntry requestParameters.ruleAction=allow requestParameters.egress=false requestParameters.aclProtocol=-1 
2| append [search `cloudtrail` eventName=CreateNetworkAclEntry OR eventName=ReplaceNetworkAclEntry requestParameters.ruleAction=allow requestParameters.egress=false requestParameters.aclProtocol!=-1 
3| eval port_range='requestParameters.portRange.to' - 'requestParameters.portRange.from' 
4| where port_range>1024] 
5| fillnull 
6| stats count min(_time) as firstTime max(_time) as lastTime by userName user_arn userIdentity.principalId eventName requestParameters.ruleAction requestParameters.egress requestParameters.aclProtocol requestParameters.portRange.to requestParameters.portRange.from src userAgent requestParameters.cidrBlock 
7| `security_content_ctime(firstTime)`
8| `security_content_ctime(lastTime)` 
9| `aws_network_access_control_list_created_with_all_open_ports_filter`

Data Source

Name	Platform	Sourcetype	Source	Supported App
AWS CloudTrail CreateNetworkAclEntry	AWS	`'aws:cloudtrail'`	`'aws_cloudtrail'`	N/A

Macros Used

Name	Value
cloudtrail	`sourcetype=aws:cloudtrail`
aws_network_access_control_list_created_with_all_open_ports_filter	`search *`

aws_network_access_control_list_created_with_all_open_ports_filter is an empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.

Annotations

- MITRE ATT&CK

+ Kill Chain Phases

+ NIST

+ CIS

- Threat Actors

ID	Technique	Tactic
T1562.007	Disable or Modify Cloud Firewall	Defense Evasion
T1562	Impair Defenses	Defense Evasion

KillChainPhase.EXPLOITAITON

NistCategory.DE_CM

Cis18Value.CIS_13

Magic Hound

Default Configuration

This detection is configured by default in Splunk Enterprise Security to run with the following settings:

Setting	Value
Disabled	true
Cron Schedule	`0 * * * *`
Earliest Time	`-70m@m`
Latest Time	`-10m@m`
Schedule Window	`auto`
Creates Notable	Yes
Rule Title	`%name%`
Rule Description	`%description%`
Notable Event Fields	user, dest
Creates Risk Event	True

This configuration file applies to all detections of type TTP. These detections will use Risk Based Alerting and generate Notable Events.

Implementation

You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS, version 4.4.0 or later, and configure your AWS CloudTrail inputs.

Known False Positives

It's possible that an admin has created this ACL with all ports open for some legitimate purpose however, this should be scoped and not allowed in production environment.

Associated Analytic Story

AWS Network ACL Activity

Risk Based Analytics (RBA)

Risk Message	Risk Score	Impact	Confidence
User $user_arn$ has created network ACLs with all the ports open to a specified CIDR $requestParameters.cidrBlock$	48	60	80

The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author.

Detection Testing

Test Type	Status	Dataset	Source	Sourcetype
Validation	✅ Passing	N/A	N/A	N/A
Unit	✅ Passing	Dataset	`aws_cloudtrail`	`aws:cloudtrail`
Integration	✅ Passing	Dataset	`aws_cloudtrail`	`aws:cloudtrail`

Replay any dataset to Splunk Enterprise by using our replay.py tool or the UI. Alternatively you can replay a dataset into a Splunk Attack Range

Source: GitHub | Version: 3