Elastic low stable kql

AWS EC2 Security Group Configuration Change

Identifies a change to an AWS Security Group Configuration. A security group is like a virtual firewall, and modifying configurations may allow unauthorized access. Threat actors may abuse this to establish persistence, exfiltrate data, or pivot in an AWS environment.

View Source

Detection Logic

data_stream.dataset: "aws.cloudtrail"
    and event.provider: "ec2.amazonaws.com"  and event.outcome: "success"
    and (event.action:(
            "AuthorizeSecurityGroupIngress" or
            "AuthorizeSecurityGroupEgress" or
            "CreateSecurityGroup" or
            "ModifySecurityGroupRules" or
            "RevokeSecurityGroupEgress" or
            "RevokeSecurityGroupIngress") or 
            (event.action: "ModifyInstanceAttribute" and aws.cloudtrail.flattened.request_parameters.groupSet.items.groupId:*))
    and not user_agent.original: (*Terraform* or *Pulumi* or *Ansible*)

False Positives

⚠ A security group may be created by a system or network administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. Security group creations by unfamiliar users or hosts should be investigated. If known behavior is causing false positives, it can be exempted from the rule.

Field Validations

Loading…

Comments (0)

Loading comments...