Detection: Cloud Network Access Control List Deleted

REMOVED DETECTION

This detection has been removed from the Splunk Threat Research content library and is no longer maintained or supported.

Reason: Detections updated to use the new search logic and field names due to the TA update

Removed in version: 5.2.0

Replacement: AWS Network Access Control List Deleted

If you have any questions or concerns, please reach out to us at research@splunk.com.

Updated Date: 2026-05-13 ID: 021abc51-1862-41dd-ad43-43c739c0a983 Author: Peter Gael, Splunk Type: Anomaly Product: Splunk Enterprise Security

Description

Enforcing network-access controls is one of the defensive mechanisms used by cloud administrators to restrict access to a cloud instance. After the attacker has gained control of the console by compromising an admin account, they can delete a network ACL and gain access to the instance from anywhere. This search will query the Change datamodel to detect users deleting network ACLs. Deprecated because it's a duplicate

Search

1`cloudtrail` eventName=DeleteNetworkAcl
2|rename userIdentity.arn as arn  
3| stats count min(_time) as firstTime max(_time) as lastTime values(errorMessage) values(errorCode) values(userAgent) values(userIdentity.*) by src userName arn eventName 
4| `security_content_ctime(lastTime)` 
5| `security_content_ctime(firstTime)` 
6| `cloud_network_access_control_list_deleted_filter`

Data Source

No data sources specified for this detection.

Macros Used

Name	Value
cloudtrail	`sourcetype=aws:cloudtrail`
cloud_network_access_control_list_deleted_filter	``

cloud_network_access_control_list_deleted_filter is an empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.

Annotations

- MITRE ATT&CK

+ Kill Chain Phases

+ NIST

+ CIS

- Threat Actors

ID	Technique	Tactic

Default Configuration

This detection is configured by default in Splunk Enterprise Security to run with the following settings:

Setting	Value
Disabled	true
Cron Schedule	`N/A`
Earliest Time	`N/A`
Latest Time	`N/A`
Schedule Window	`N/A`
Creates Finding (Notable)	No
Creates Intermediate Finding (Risk Event)	No

Anomaly detections generate Intermediate Findings (Risk Events). They do not generate a Finding (Notable) directly.

Implementation

You must be ingesting your cloud infrastructure logs from your cloud provider. You can also provide additional filtering for this search by customizing the cloud_network_access_control_list_deleted_filter macro.

Known False Positives

It's possible that a user has legitimately deleted a network ACL.

Associated Analytic Story

AWS Network ACL Activity

Detection Testing

Test Type	Status	Dataset	Source	Sourcetype
Validation	Not Applicable	N/A	N/A	N/A
Unit	Not Applicable	N/A	`N/A`	`N/A`
Integration	Not Applicable	N/A	`N/A`	`N/A`

Replay any dataset to Splunk Enterprise by using our replay.py tool or the UI. Alternatively you can replay a dataset into a Splunk Attack Range

Source: GitHub |

Version: 4