AWS WAF Disassociation

Severity: critical
Entities: aws_account_ids, aws_arns, domain_names, trace_ids
Log types: AWS.CloudTrail
Tags: AWS, Web Application Firewall, Defense Evasion, Impair Defenses, Network Security
Reference: https://docs.aws.amazon.com/waf/latest/APIReference/API_DisassociateWebACL.html
Source: github.com/panther-labs/panther-analysis

Detects when AWS WAF is disassociated from protected resources such as Application Load Balancers, API Gateway, CloudFront, or AppSync. Removing WAF protection exposes applications to SQL injection, XSS, DDoS attacks, and OWASP Top 10 vulnerabilities. Attackers often disable WAF before launching attacks, or this may indicate misconfiguration or unauthorized changes.

MITRE ATT&CK coverage

Tactic	Techniques
Stealth	`T1562.004` Impair Defenses: Disable or Modify System Firewall

Rule body yaml

AnalysisType: rule
Description: >
  Detects when AWS WAF is disassociated from protected resources such as Application Load Balancers, API Gateway, CloudFront, or AppSync. Removing WAF protection exposes applications to SQL injection, XSS, DDoS attacks, and OWASP Top 10 vulnerabilities. Attackers often disable WAF before launching attacks, or this may indicate misconfiguration or unauthorized changes.
DisplayName: "AWS WAF Disassociation"
Enabled: true
Filename: aws_waf_disassociation.py
Reference: https://docs.aws.amazon.com/waf/latest/APIReference/API_DisassociateWebACL.html
Runbook: |
  1. Query ALB access logs, CloudFront logs, or API Gateway logs for requestParameters.resourceArn in the timeframe between this DisassociateWebACL event and WAF re-association to identify attack traffic that reached the unprotected resource
  2. Search for SQL injection patterns, XSS payloads, or unusual request volumes in the application logs that may indicate exploitation while WAF protection was removed
  3. Review CloudTrail for other security-related API calls by userIdentity.arn in the 6 hours around this event to identify if other defensive controls were modified or disabled
Severity: Critical
Tags:
  - AWS
  - Web Application Firewall
  - Defense Evasion
  - Impair Defenses
  - Network Security
Reports:
  MITRE ATT&CK:
    - TA0005:T1562.004
Tests:
  - ExpectedResult: true
    Log:
      apiVersion: "2019-04-23"
      awsRegion: us-west-2
      eventCategory: Management
      eventID: 94678efc-2176-462c-b0c9-a612881a39ed
      eventName: DisassociateWebACL
      eventSource: wafv2.amazonaws.com
      eventTime: "2022-09-29 23:04:35"
      eventType: AwsApiCall
      eventVersion: "1.08"
      managementEvent: true
      p_any_aws_account_ids:
        - "012345678910"
      p_any_aws_arns:
        - arn:aws:elasticloadbalancing:us-west-2:012345678910:loadbalancer/app/web/84dc5457e450dba5
        - arn:aws:iam::012345678910:role/DevAdministrator
        - arn:aws:sts::012345678910:assumed-role/DevAdministrator/example_user
      p_any_domain_names:
        - AWS Internal
      p_any_trace_ids:
        - ASIARLIVEKVNJNSTUSF6
      p_event_time: "2022-09-29 23:04:35"
      p_log_type: AWS.CloudTrail
      p_parse_time: "2022-09-29 23:08:26.172"
      p_row_id: 5ad3a83ca88f938cbff8fdd913d1ce1d
      p_source_id: 125a8146-e3ea-454b-aed7-9e08e735b670
      p_source_label: Panther Identity Org CloudTrail
      readOnly: false
      recipientAccountId: "012345678910"
      requestID: e4d47992-90f1-47f0-bff7-de18a8277005
      requestParameters:
        resourceArn: arn:aws:elasticloadbalancing:us-west-2:012345678910:loadbalancer/app/web/84dc5457e450dba5
      sessionCredentialFromConsole: true
      sourceIPAddress: AWS Internal
      userAgent: AWS Internal
      userIdentity:
        accessKeyId: ASIARLIVEKVNJNSTUSF6
        accountId: "012345678910"
        arn: arn:aws:sts::012345678910:assumed-role/DevAdministrator/example_user
        principalId: AROARLIVEKVNIRVGDLJWJ:example_user
        sessionContext:
          attributes:
            creationDate: "2022-09-29T22:51:13Z"
            mfaAuthenticated: "true"
          sessionIssuer:
            accountId: "012345678910"
            arn: arn:aws:iam::012345678910:role/DevAdministrator
            principalId: AROARLIVEKVNIRVGDLJWJ
            type: Role
            userName: DevAdministrator
          webIdFederationData: {}
        type: AssumedRole
    Name: WAF-Disassociate
  - ExpectedResult: false
    Log:
      apiVersion: "2019-04-23"
      awsRegion: us-west-2
      eventCategory: Management
      eventID: 94678efc-2176-462c-b0c9-a612881a39ed
      eventName: ListWebACLs
      eventSource: wafv2.amazonaws.com
      eventTime: "2022-09-29 23:04:35"
      eventType: AwsApiCall
      eventVersion: "1.08"
      managementEvent: true
      p_any_aws_account_ids:
        - "012345678910"
      p_any_aws_arns:
        - arn:aws:elasticloadbalancing:us-west-2:012345678910:loadbalancer/app/web/84dc5457e450dba5
        - arn:aws:iam::012345678910:role/DevAdministrator
        - arn:aws:sts::012345678910:assumed-role/DevAdministrator/example_user
      p_any_domain_names:
        - AWS Internal
      p_any_trace_ids:
        - ASIARLIVEKVNJNSTUSF6
      p_event_time: "2022-09-29 23:04:35"
      p_log_type: AWS.CloudTrail
      p_parse_time: "2022-09-29 23:08:26.172"
      p_row_id: 5ad3a83ca88f938cbff8fdd913d1ce1d
      p_source_id: 125a8146-e3ea-454b-aed7-9e08e735b670
      p_source_label: Panther Identity Org CloudTrail
      readOnly: false
      recipientAccountId: "012345678910"
      requestID: e4d47992-90f1-47f0-bff7-de18a8277005
      requestParameters:
        resourceArn: arn:aws:elasticloadbalancing:us-west-2:012345678910:loadbalancer/app/web/84dc5457e450dba5
      sessionCredentialFromConsole: true
      sourceIPAddress: AWS Internal
      userAgent: AWS Internal
      userIdentity:
        accessKeyId: ASIARLIVEKVNJNSTUSF6
        accountId: "012345678910"
        arn: arn:aws:sts::012345678910:assumed-role/DevAdministrator/example_user
        principalId: AROARLIVEKVNIRVGDLJWJ:example_user
        sessionContext:
          attributes:
            creationDate: "2022-09-29T22:51:13Z"
            mfaAuthenticated: "true"
          sessionIssuer:
            accountId: "012345678910"
            arn: arn:aws:iam::012345678910:role/DevAdministrator
            principalId: AROARLIVEKVNIRVGDLJWJ
            type: Role
            userName: DevAdministrator
          webIdFederationData: {}
        type: AssumedRole
    Name: WAF - List WebACLs
DedupPeriodMinutes: 60
LogTypes:
  - AWS.CloudTrail
RuleID: "AWS.WAF.Disassociation"
Threshold: 1

Detection logic

Condition

eventName eq "DisassociateWebACL"

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

Field	Kind	Values
`eventName`	eq	`DisassociateWebACL`

Output fields

Fields the rule emits when it matches. Chronicle authors list these in the outcome block; they appear on the detection and $risk_score drives alerting. Sentinel / Defender XDR rules build them up through project / summarize / extend stages. Sentinel maps these into alert fields via entityMappings and customDetails; Defender XDR custom detections surface them as alert fields directly.

Field	Source
`awsRegion`
`eventName`
`recipientAccountId`
`requestID`
`actor_user`
`requestParameters`	`requestParameters.resourceArn`
`userIdentity`	`userIdentity.principalId`

`j` / `k`	Scroll down / up
`d` / `u`	Half-page down / up
`gg` / `G`	Top / bottom
`h` / `l`	History back / forward
`f`	Follow link (`Shift` = new tab)
`/`	Focus search
`?`	Toggle this help
`↑` / `↓`	Navigate search results
`Enter`	Open highlighted result
`Esc`	Close results / dialog

`type:`	`events` / `rules` / `providers`
`vendor:`	`sigma` / `elastic` / `splunk` / `kusto` / `chronicle` (vendor name alone also works: `sigma:`, `kql:`, `secops:`…)
`tactic:`	TA-id, slug, or name: `credential_access`, `TA0006`
`technique:`	technique or sub-technique ID: `T1003`, `T1003.001` (alias `tech:`)
`severity:`	`critical` / `high` / `medium` / `low` / `informational` (alias `sev:`)
`risk_score`	Numeric comparison on the Elastic risk score (0 to 100): `risk_score>50`, `risk_score<=20`, `risk_score=99` (alias `risk`; Elastic rules only)
`stages:`	Rules with exactly N pipeline stages
`correlation:`	`single_event` / `sequence` / `alternatives` / `alternatives_cross_log` / `all_required` / `correlated`
`with:`	Co-occurrence event-id; stacks (`with:4624 with:4769`) to require all, while a comma list in one occurrence (`with:4624,4769`) is an either-or group. Implies multi-event
`like:`	Structural neighbors of a rule slug (equivalents + subsumption stricter / broader): `like:comsvcs_lsass_memory_dump-splunk-sysmon`
`groupby:`	Entity-grouping substring match against `group_by_keys`: `groupby:user`, `groupby:host`
`uses:`	Rules whose predicate tree touches the field (any kind, any value): `uses:CommandLine`
`excludes:`	Rules with top-level `not()` clauses on the field (FP whitelists): `excludes:ParentImage`
`field:` / `value:`	Predicate search; narrows rule cards to those with a matching leaf and drives the indicator tier. Unquoted = substring, wildcards allowed (`value:mimikatz`)
`indicator:`	Shorthand for `field:F value:V`: `indicator:Image=*\powershell.exe`
`kind:`	Filter by predicate kind. Narrows rule cards to those carrying a matching predicate leaf (`vendor:elastic kind:cidr_match`) and drives the indicator tier: `contains` / `starts_with` / `ends_with` / `regex` / `cidr` / `eq` / `in` … (operator aliases `op:`/`match:`)
`has:` / `no:`	`sample`, `field`, `notes`, `refs`, `trace`, `thirdparty`, `rule`, `pattern`, `timewindow`, `threshold`, `newterms`, `sigma`/`elastic`/`splunk`/`kusto`/`chronicle`
`-op:val`	Exclude matches; works on most operators but not `type:`/`like:`/`has:`/`no:` (use `no:<flag>` to exclude a rule flag): `tactic:execution -vendor:splunk`. Standalone `-kind:`/`-field:`/`-value:` drop every rule carrying a matching predicate leaf (`type:rules -kind:is_null`)
`field:"…"` / `value:"…"`	Quoted value = anchored exact match (also allows spaces): `value:"net user"`
`a,b`	Comma = OR inside one operator (`vendor:sigma,elastic`, `severity:high,critical`); repeating a facet merges the same way. `field:`/`value:` never split (literal commas)
`vendors:` / `stage:`	Singular and plural spellings fold to the canonical operator and value: `tactics:` = `tactic:`, `type:event` = `type:events`, `correlation:sequences` = `correlation:sequence`, `has:thresholds` = `has:threshold`
`"quoted phrase"`	Exact-match a multi-word phrase (free text)