Ingress/Egress Security Group Modification

Status: test
Severity: medium
Log source: product aws, service cloudtrail
Author: jamesc-grafana
Source: github.com/SigmaHQ/sigma

Detects when an account makes changes to the ingress or egress rules of a security group. This can indicate that an attacker is attempting to open up new attack vectors in the account, that they are trying to exfiltrate data over the network, or that they are trying to allow machines in that VPC/Subnet to contact a C&C server.

Known false positives

New VPCs and Subnets being setup requiring a different security profile to those already defined
A single port being opened for a new service that is known to be deploying
Administrators closing unused ports to reduce the attack surface

MITRE ATT&CK coverage

Tactic	Techniques
Initial Access	`T1190` Exploit Public-Facing Application

Telemetry coverage

Platform	Record / event type
AWS	CloudTrail event `AuthorizeSecurityGroupEgress`: Adds outbound rules to a security group to allow traffic to the specified destination.
AWS	CloudTrail event `AuthorizeSecurityGroupIngress`: Adds inbound rules to a security group to allow traffic from the specified source.
AWS	CloudTrail event `RevokeSecurityGroupEgress`: Removes outbound rules from a security group.
AWS	CloudTrail event `RevokeSecurityGroupIngress`: Removes inbound rules from a security group.

Rules detecting the same action

These rules filter on the same operation.

AWS EC2 Security Group Configuration Change (Elastic)
Ingress Port 22 Opened (Sigma)
Insecure AWS EC2 VPC Security Group Ingress Rule Added (Elastic)

Rule body

title: Ingress/Egress Security Group Modification
id: 6fb77778-040f-4015-9440-572aa9b6b580
status: test
description: |
    Detects when an account makes changes to the ingress or egress rules of a security group.
    This can indicate that an attacker is attempting to open up new attack vectors in the account, that they are trying to exfiltrate data over the network, or that they are trying to allow machines in that VPC/Subnet to contact a C&C server.
references:
    - https://www.gorillastack.com/blog/real-time-events/important-aws-cloudtrail-security-events-tracking/
author: jamesc-grafana
date: 2024-07-11
tags:
    - attack.initial-access
    - attack.t1190
logsource:
    product: aws
    service: cloudtrail
detection:
    selection:
        eventSource: 'ec2.amazonaws.com'
        eventName:
            - 'AuthorizeSecurityGroupEgress'
            - 'AuthorizeSecurityGroupIngress'
            - 'RevokeSecurityGroupEgress'
            - 'RevokeSecurityGroupIngress'
    condition: selection
falsepositives:
    - New VPCs and Subnets being setup requiring a different security profile to those already defined
    - A single port being opened for a new service that is known to be deploying
    - Administrators closing unused ports to reduce the attack surface
level: medium

Stages and Predicates

Stage 0: `condition`

selection

Stage 1: `selection`

selection:
    eventSource: 'ec2.amazonaws.com'
    eventName:
        - 'AuthorizeSecurityGroupEgress'
        - 'AuthorizeSecurityGroupIngress'
        - 'RevokeSecurityGroupEgress'
        - 'RevokeSecurityGroupIngress'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`eventName`	eq	`AuthorizeSecurityGroupEgress` `AuthorizeSecurityGroupIngress` `RevokeSecurityGroupEgress` `RevokeSecurityGroupIngress`	`field:"aws::eventName" kind:eq`
`eventSource`	eq	`ec2.amazonaws.com`	`field:"aws::eventSource" kind:eq value:"ec2.amazonaws.com"`