AWSCloudTrail - Changes to Amazon VPC settings

Status: available
Severity: low
Time window: 1d
Group by: AWSRegion, AccountName, AccountUPNSuffix, AdditionalEventData, EventName, EventSource, EventTypeName, RecipientAccountId, ResponseElements, SessionMfaAuthenticated, SourceIpAddress, UserAgent, UserIdentityAccountId, UserIdentityPrincipalid, UserIdentityUserName
Source: github.com/Azure/Azure-Sentinel

Identifies changes to Amazon VPC(Virtual Private Cloud) settings that can alter network exposure, routing, or access controls. This rule identifies changes to Amazon VPC (Virtual Private Cloud) settings such as new ACL entries, routes, routetable or Gateways. AWS VPC API Docs: https://docs.aws.amazon.com/AWSEC2/latest/APIReference/OperationList-query-vpc.html'

MITRE ATT&CK coverage

Tactic	Techniques
Privilege Escalation	`T1078` Valid Accounts
Stealth	`T1078` Valid Accounts
Defense Impairment	`T1685` Disable or Modify Tools `T1686.001` Disable or Modify System Firewall: Cloud Firewall

Telemetry coverage

Platform	Record / event type
AWS	CloudTrail event `CreateNetworkAclEntry`: Creates an entry (rule) in a network ACL with the specified rule number, protocol, and traffic action.
AWS	CloudTrail event `CreateRouteTable`: Creates a route table for the specified VPC.
AWS	CloudTrail event `CreateInternetGateway`: Creates an Internet gateway for use with a VPC.
AWS	CloudTrail event `CreateNatGateway`: Creates a NAT gateway in the specified subnet.

Rules detecting the same action

These rules filter on the same operation.

ASL AWS Network Access Control List Created with All Open Ports (Splunk)
AWS Network Access Control List Created with All Open Ports (Splunk)
AWSCloudTrail - Network ACL with all the open ports to a specified CIDR (Kusto)
EC2 Network ACL Modified (Panther)
EC2 Network Gateway Modified (Panther)
EC2 Route Table Modified (Panther)

Rule body

id: 65360bb0-8986-4ade-a89d-af3cf44d28aa
name: AWSCloudTrail - Changes to Amazon VPC settings
description: |
  Identifies changes to Amazon VPC(Virtual Private Cloud) settings that can alter network exposure, routing, or access controls.
  This rule identifies changes to Amazon VPC (Virtual Private Cloud) settings such as new ACL entries, routes, routetable or Gateways. 
  AWS VPC API Docs: https://docs.aws.amazon.com/AWSEC2/latest/APIReference/OperationList-query-vpc.html'
severity: Low
status: Available
requiredDataConnectors:
 - connectorId: AWS
   dataTypes:
    - AWSCloudTrail
 - connectorId: AWSS3
   dataTypes:
    - AWSCloudTrail
queryFrequency: 1d
queryPeriod: 1d
triggerOperator: gt
triggerThreshold: 0
tactics:
  - PrivilegeEscalation
  - DefenseEvasion
relevantTechniques:
  - T1078
  - T1562.007
query: |
  let EventNameList = dynamic(["CreateNetworkAclEntry","CreateRoute","CreateRouteTable","CreateInternetGateway","CreateNatGateway"]);
  AWSCloudTrail
  | where EventName in~ (EventNameList)
  | where EventSource != "apigateway.amazonaws.com"
  | extend UserIdentityArn = iif(isempty(UserIdentityArn), tostring(parse_json(Resources)[0].ARN), UserIdentityArn)
  | extend UserName = tostring(split(UserIdentityArn, '/')[-1])
  | extend AccountName = case( UserIdentityPrincipalid == "Anonymous", "Anonymous", isempty(UserIdentityUserName), UserName, UserIdentityUserName)
  | extend AccountName = iif(AccountName contains "@", tostring(split(AccountName, '@', 0)[0]), AccountName),
    AccountUPNSuffix = iif(AccountName contains "@", tostring(split(AccountName, '@', 1)[0]), "")
  | summarize StartTimeUtc = min(TimeGenerated), EndTimeUtc = max(TimeGenerated) by EventName, EventTypeName, RecipientAccountId, AccountName, AccountUPNSuffix, UserIdentityAccountId, UserIdentityPrincipalid, UserAgent,
  UserIdentityUserName, SessionMfaAuthenticated, SourceIpAddress, AWSRegion, EventSource, AdditionalEventData, ResponseElements
entityMappings:
  - entityType: Account
    fieldMappings:
      - identifier: Name
        columnName: AccountName
      - identifier: UPNSuffix
        columnName: AccountUPNSuffix
      - identifier: CloudAppAccountId
        columnName: RecipientAccountId
  - entityType: IP
    fieldMappings:
      - identifier: Address
        columnName: SourceIpAddress
customDetails:
  AWSRegion: AWSRegion
  RecipientAccountId: RecipientAccountId
  EventName: EventName
  EventSource: EventSource
alertDetailsOverride:
  alertDisplayNameFormat: 'AWS VPC change by {{AccountName}} in {{AWSRegion}}'
  alertDescriptionFormat: 'Event {{EventName}} executed by {{AccountName}} from {{SourceIpAddress}}.'
version: 1.0.8
kind: Scheduled

Stages and Predicates

Parameters

let EventNameList = dynamic(["CreateNetworkAclEntry","CreateRoute","CreateRouteTable","CreateInternetGateway","CreateNatGateway"]);

Stage 1: `source`

AWSCloudTrail

Stage 2: `where`

| where EventName in~ (EventNameList)

Stage 3: `where`

| where EventSource != "apigateway.amazonaws.com"

Stage 4: `extend` (4 consecutive steps)

| extend UserIdentityArn = iif(isempty(UserIdentityArn), tostring(parse_json(Resources)[0].ARN), UserIdentityArn)
| extend UserName = tostring(split(UserIdentityArn, '/')[-1])
| extend AccountName = case( UserIdentityPrincipalid == "Anonymous", "Anonymous", isempty(UserIdentityUserName), UserName, UserIdentityUserName)
| extend AccountName = iif(AccountName contains "@", tostring(split(AccountName, '@', 0)[0]), AccountName),
  AccountUPNSuffix = iif(AccountName contains "@", tostring(split(AccountName, '@', 1)[0]), "")

Stage 5: `summarize`

| summarize StartTimeUtc = min(TimeGenerated), EndTimeUtc = max(TimeGenerated) by EventName, EventTypeName, RecipientAccountId, AccountName, AccountUPNSuffix, UserIdentityAccountId, UserIdentityPrincipalid, UserAgent,
UserIdentityUserName, SessionMfaAuthenticated, SourceIpAddress, AWSRegion, EventSource, AdditionalEventData, ResponseElements

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`EventName`	in	`CreateInternetGateway` `CreateNatGateway` `CreateNetworkAclEntry` `CreateRoute` `CreateRouteTable`	`field:"aws::eventName" kind:in`
`EventSource`	ne	`apigateway.amazonaws.com`	`field:"aws::eventSource" kind:ne value:"apigateway.amazonaws.com"`

Output fields

These fields are emitted when the rule matches.

Field	Source
`AWSRegion`	`summarize`
`AccountName`	`summarize`
`AccountUPNSuffix`	`summarize`
`AdditionalEventData`	`summarize`
`EndTimeUtc`	`summarize`
`EventName`	`summarize`
`EventSource`	`summarize`
`EventTypeName`	`summarize`
`RecipientAccountId`	`summarize`
`ResponseElements`	`summarize`
`SessionMfaAuthenticated`	`summarize`
`SourceIpAddress`	`summarize`
`StartTimeUtc`	`summarize`
`UserAgent`	`summarize`
`UserIdentityAccountId`	`summarize`
`UserIdentityPrincipalid`	`summarize`
`UserIdentityUserName`	`summarize`