Ingress Port 22 Opened

Status: test
Severity: medium
Log source: product aws, service cloudtrail
Author: Zach Mathis (@yamatosecurity)
Source: github.com/Yamato-Security/suzaku-rules

Ingress port 22 was opened in a security group for an EC2 instance. This is a common tactic used by attackers to establish access into the environment via SSH for a variety of reasons (exfil, etc...).

MITRE ATT&CK coverage

Tactic	Techniques
Persistence	No specific technique
Exfiltration	No specific technique

Telemetry coverage

Platform	Record / event type
AWS	CloudTrail event `AuthorizeSecurityGroupIngress`: Adds inbound rules to a security group to allow traffic from the specified source.

Rules detecting the same action

These rules filter on the same operation.

AWS EC2 Security Group Configuration Change (Elastic)
Ingress/Egress Security Group Modification (Sigma)
Insecure AWS EC2 VPC Security Group Ingress Rule Added (Elastic)

Rule body

title: Ingress Port 22 Opened 
id: 372d79d1-73c5-48db-aa98-18b1a03fc9fc
status: test
description: |
    Ingress port 22 was opened in a security group for an EC2 instance.
    This is a common tactic used by attackers to establish access into the environment via SSH for a variety of reasons (exfil, etc...).
references:
    - https://stratus-red-team.cloud/attack-techniques/AWS/aws.exfiltration.ec2-security-group-open-port-22-ingress/
author: Zach Mathis (@yamatosecurity)
date: 2025-04-24
modified: 2025-04-24
tags:
    - attack.exfiltration
    - attack.persistence
logsource:
    product: aws
    service: cloudtrail
detection:
    selection:
        eventSource: 'ec2.amazonaws.com'
        eventName: 'AuthorizeSecurityGroupIngress'
    selection_port_ranges:
        - requestParameters.fromPort: '22'
        - requestParameters.toPort: '22'
    condition: selection and selection_port_ranges
falsepositives:
level: medium

Stages and Predicates

Stage 0: `condition`

selection and selection_port_ranges

Stage 1: `selection`

selection:
    eventSource: 'ec2.amazonaws.com'
    eventName: 'AuthorizeSecurityGroupIngress'

Stage 2: `selection_port_ranges`

selection_port_ranges:
    - requestParameters.fromPort: '22'
    - requestParameters.toPort: '22'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`eventName`	eq	`AuthorizeSecurityGroupIngress`	`field:"aws::eventName" kind:eq value:"AuthorizeSecurityGroupIngress"`
`eventSource`	eq	`ec2.amazonaws.com`	`field:"aws::eventSource" kind:eq value:"ec2.amazonaws.com"`
`requestParameters.fromPort`	eq	`22`	`field:"requestParameters.fromPort" kind:eq value:"22"`
`requestParameters.toPort`	eq	`22`	`field:"requestParameters.toPort" kind:eq value:"22"`