Splunk unknown stable spl

AWS Network Access Control List Deleted

The following analytic detects the deletion of AWS Network Access Control Lists (ACLs). It leverages AWS CloudTrail logs to identify events where a user deletes a network ACL entry. This activity is significant because deleting a network ACL can remove critical access restrictions, potentially allowing unauthorized access to cloud instances. If confirmed malicious, this action could enable attackers to bypass network security controls, leading to unauthorized access, data exfiltration, or further compromise of the cloud environment.

View Source

Detection Logic

`cloudtrail` eventName=DeleteNetworkAclEntry requestParameters.egress=false
| fillnull
| rename user_name as user
| stats count min(_time) as firstTime max(_time) as lastTime
    BY signature dest user
       user_agent src vendor_account
       vendor_region vendor_product
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `aws_network_access_control_list_deleted_filter`

False Positives

  • ⚠ It's possible that a user has legitimately deleted a network ACL.

Field Validations

Loading…

Comments (0)

Loading comments...