AWSCloudTrail - Network ACL with all the open ports to a specified CIDR

Status: available
Severity: high
Time window: 1d
Source: github.com/Azure/Azure-Sentinel

Detects Network ACL entries that allow very broad inbound access ranges, including all protocols or large port ranges. Such changes can significantly increase exposure and may indicate weakening of cloud network controls.

MITRE ATT&CK coverage

Tactic	Techniques
Defense Impairment	`T1685` Disable or Modify Tools `T1686.001` Disable or Modify System Firewall: Cloud Firewall

Telemetry coverage

Platform	Record / event type
AWS	CloudTrail event `CreateNetworkAclEntry`: Creates an entry (rule) in a network ACL with the specified rule number, protocol, and traffic action.
AWS	CloudTrail event `ReplaceNetworkAclEntry`: Replaces an entry (rule) in a network ACL, changing subnet traffic filtering.

Rules detecting the same action

These rules filter on the same operation.

ASL AWS Network Access Control List Created with All Open Ports (Splunk)
AWS Network Access Control List Created with All Open Ports (Splunk)
AWSCloudTrail - Changes to Amazon VPC settings (Kusto)
EC2 Network ACL Modified (Panther)

Rule body

id: f8ea7d50-e33b-4b9d-9c3e-a59fcbcee281
name: AWSCloudTrail - Network ACL with all the open ports to a specified CIDR
description: |
  Detects Network ACL entries that allow very broad inbound access ranges, including all protocols or large port
  ranges. Such changes can significantly increase exposure and may indicate weakening of cloud network controls.
severity: High
status: Available
requiredDataConnectors:
  - connectorId: AWS
    dataTypes:
      - AWSCloudTrail
queryFrequency: 1d
queryPeriod: 1d
triggerOperator: gt
triggerThreshold: 0
tactics:
  - DefenseEvasion
relevantTechniques:
  - T1562.007
query: |
    AWSCloudTrail
    | where EventName in ('CreateNetworkAclEntry', 'ReplaceNetworkAclEntry') and isempty(ErrorMessage) and isempty(ErrorCode)
    | extend ruleAction = tostring(parse_json(RequestParameters)['ruleAction']),
             egress=parse_json(RequestParameters)['egress'],
             total_ports=(toint(parse_json(parse_json(RequestParameters)['portRange'])['to']) - toint(parse_json(parse_json(RequestParameters)['portRange'])['from'])),
             aclProtocol=parse_json(RequestParameters)['aclProtocol']
    | where isnotempty(total_ports)
    | where ruleAction == 'allow' and egress == false and (aclProtocol == '-1' or (total_ports > 1024))
    | extend UserIdentityArn = iif(isempty(UserIdentityArn), tostring(parse_json(Resources)[0].ARN), UserIdentityArn)
    | extend UserName = tostring(split(UserIdentityArn, '/')[-1])
    | extend AccountName = case( UserIdentityPrincipalid == "Anonymous", "Anonymous", isempty(UserIdentityUserName), UserName, UserIdentityUserName)
    | extend AccountName = iif(AccountName contains "@", tostring(split(AccountName, '@', 0)[0]), AccountName),
      AccountUPNSuffix = iif(AccountName contains "@", tostring(split(AccountName, '@', 1)[0]), "")
entityMappings:
  - entityType: Account
    fieldMappings:
      - identifier: Name
        columnName: AccountName
      - identifier: UPNSuffix
        columnName: AccountUPNSuffix
      - identifier: CloudAppAccountId
        columnName: RecipientAccountId
  - entityType: IP
    fieldMappings:
      - identifier: Address
        columnName: SourceIpAddress
customDetails:
  EventName: EventName
  RuleAction: ruleAction
  AclProtocol: aclProtocol
  AWSRegion: AWSRegion
alertDetailsOverride:
  alertDisplayNameFormat: 'AWS Network ACL overly permissive rule by {{AccountName}} in {{AWSRegion}}'
  alertDescriptionFormat: 'Detected {{EventName}} from {{SourceIpAddress}} that opened broad Network ACL access in account {{RecipientAccountId}}.'
version: 1.0.3
kind: Scheduled

Stages and Predicates

Stage 1: `source`

AWSCloudTrail

Stage 2: `where`

| where EventName in ('CreateNetworkAclEntry', 'ReplaceNetworkAclEntry') and isempty(ErrorMessage) and isempty(ErrorCode)

Stage 3: `extend`

| extend ruleAction = tostring(parse_json(RequestParameters)['ruleAction']),
         egress=parse_json(RequestParameters)['egress'],
         total_ports=(toint(parse_json(parse_json(RequestParameters)['portRange'])['to']) - toint(parse_json(parse_json(RequestParameters)['portRange'])['from'])),
         aclProtocol=parse_json(RequestParameters)['aclProtocol']

Stage 4: `where`

| where isnotempty(total_ports)

Stage 5: `where`

| where ruleAction == 'allow' and egress == false and (aclProtocol == '-1' or (total_ports > 1024))

Stage 6: `extend` (4 consecutive steps)

| extend UserIdentityArn = iif(isempty(UserIdentityArn), tostring(parse_json(Resources)[0].ARN), UserIdentityArn)
| extend UserName = tostring(split(UserIdentityArn, '/')[-1])
| extend AccountName = case( UserIdentityPrincipalid == "Anonymous", "Anonymous", isempty(UserIdentityUserName), UserName, UserIdentityUserName)
| extend AccountName = iif(AccountName contains "@", tostring(split(AccountName, '@', 0)[0]), AccountName),
  AccountUPNSuffix = iif(AccountName contains "@", tostring(split(AccountName, '@', 1)[0]), "")

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`ErrorCode`	is_null	(no value, null check)	`field:"aws::errorCode" kind:is_null`
`ErrorMessage`	is_null	(no value, null check)	`field:"aws::errorMessage" kind:is_null`
`EventName`	in	`CreateNetworkAclEntry` `ReplaceNetworkAclEntry`	`field:"aws::eventName" kind:in`
`aclProtocol`	eq	`-1`	`field:"aclProtocol" kind:eq value:"-1"`
`egress`	eq	`false`	`field:"egress" kind:eq value:"false"`
`ruleAction`	eq	`allow`	`field:"ruleAction" kind:eq value:"allow"`
`total_ports`	gt	`1024`	`field:"total_ports" kind:gt value:"1024"`
`total_ports`	is_not_null	(no value, null check)	`field:"total_ports" kind:is_not_null`

Output fields

These fields are emitted when the rule matches.

Field	Source
`aclProtocol`	`extend`
`egress`	`extend`
`ruleAction`	`extend`
`total_ports`	`extend`
`UserIdentityArn`	`extend`
`UserName`	`extend`
`AccountName`	`extend`
`AccountUPNSuffix`	`extend`