Detection: AWS Network Access Control List Created with All Open Ports

Updated Date: 2024-09-30 ID: ada0f478-84a8-4641-a3f1-d82362d6bd75 Author: Bhavin Patel, Patrick Bareiss, Splunk Type: TTP Product: Splunk Enterprise Security

Description

The following analytic detects the creation of AWS Network Access Control Lists (ACLs) with all ports open to a specified CIDR. It leverages AWS CloudTrail events, specifically monitoring for CreateNetworkAclEntry or ReplaceNetworkAclEntry actions with rules allowing all traffic. This activity is significant because it can expose the network to unauthorized access, increasing the risk of data breaches and other malicious activities. If confirmed malicious, an attacker could exploit this misconfiguration to gain unrestricted access to the network, potentially leading to data exfiltration, service disruption, or further compromise of the AWS environment.

1`cloudtrail` eventName=CreateNetworkAclEntry OR eventName=ReplaceNetworkAclEntry requestParameters.ruleAction=allow requestParameters.egress=false requestParameters.aclProtocol=-1 
2| append [search `cloudtrail` eventName=CreateNetworkAclEntry OR eventName=ReplaceNetworkAclEntry requestParameters.ruleAction=allow requestParameters.egress=false requestParameters.aclProtocol!=-1 
3| eval port_range='requestParameters.portRange.to' - 'requestParameters.portRange.from' 
4| where port_range>1024] 
5| fillnull 
6| stats count min(_time) as firstTime max(_time) as lastTime by userName user_arn userIdentity.principalId eventName requestParameters.ruleAction requestParameters.egress requestParameters.aclProtocol requestParameters.portRange.to requestParameters.portRange.from src userAgent requestParameters.cidrBlock 
7| `security_content_ctime(firstTime)`
8| `security_content_ctime(lastTime)` 
9| `aws_network_access_control_list_created_with_all_open_ports_filter`

Data Source

Name Platform Sourcetype Source
AWS CloudTrail CreateNetworkAclEntry AWS icon AWS 'aws:cloudtrail' 'aws_cloudtrail'
AWS CloudTrail ReplaceNetworkAclEntry AWS icon AWS 'aws:cloudtrail' 'aws_cloudtrail'

Macros Used

Name Value
cloudtrail sourcetype=aws:cloudtrail
aws_network_access_control_list_created_with_all_open_ports_filter search *
aws_network_access_control_list_created_with_all_open_ports_filter is an empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.

Annotations

- MITRE ATT&CK
+ Kill Chain Phases
+ NIST
+ CIS
- Threat Actors
ID Technique Tactic
T1562.007 Disable or Modify Cloud Firewall Defense Evasion
T1562 Impair Defenses Defense Evasion
KillChainPhase.EXPLOITAITON
NistCategory.DE_CM
Cis18Value.CIS_13
Magic Hound

Default Configuration

This detection is configured by default in Splunk Enterprise Security to run with the following settings:

Setting Value
Disabled true
Cron Schedule 0 * * * *
Earliest Time -70m@m
Latest Time -10m@m
Schedule Window auto
Creates Notable Yes
Rule Title %name%
Rule Description %description%
Notable Event Fields user, dest
Creates Risk Event True
This configuration file applies to all detections of type TTP. These detections will use Risk Based Alerting and generate Notable Events.

Implementation

You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS, version 4.4.0 or later, and configure your AWS CloudTrail inputs.

Known False Positives

It's possible that an admin has created this ACL with all ports open for some legitimate purpose however, this should be scoped and not allowed in production environment.

Associated Analytic Story

Risk Based Analytics (RBA)

Risk Message Risk Score Impact Confidence
User $user_arn$ has created network ACLs with all the ports open to a specified CIDR $requestParameters.cidrBlock$ 48 60 80
The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author.

Detection Testing

Test Type Status Dataset Source Sourcetype
Validation ✅ Passing N/A N/A N/A
Unit ✅ Passing Dataset aws_cloudtrail aws:cloudtrail
Integration ✅ Passing Dataset aws_cloudtrail aws:cloudtrail

Replay any dataset to Splunk Enterprise by using our replay.py tool or the UI. Alternatively you can replay a dataset into a Splunk Attack Range

Source: GitHub | Version: 4