AWS EC2 NACL Entry Created or Replaced Allowing All Traffic by New Identity

  1[metadata]
  2creation_date = "2026/07/27"
  3integration = ["aws"]
  4maturity = "production"
  5updated_date = "2026/07/27"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Detects a principal account creating or replacing - or attempts to create or replace - an AWS Network 
 11Access Control List (NACL) entry using protocol -1 (all traffic). Both successful and failed outcomes 
 12are included. A NACL entry with protocol -1 passes all traffic regardless of port, which would disable 
 13network-layer controls for the affected subnets. Monitoring for new identities performing this change 
 14helps surface freshly compromised credentials or unauthorized principals removing a defense-in-depth 
 15layer to facilitate lateral movement or data exfiltration. This signal only flags if this behavior was 
 16not observed historically in a specific time window.
 17"""
 18false_positives = [
 19    """
 20    Some legitimate architectures use permissive NACLs as a passthrough layer while relying
 21    on security groups for access control. Validate that the modified NACL is associated with
 22    subnets where this design pattern is expected and that the change was authorized through
 23    a change management process.
 24    """,
 25]
 26from = "now-6m"
 27index = ["logs-aws.cloudtrail-*"]
 28interval = "5m"
 29language = "kuery"
 30license = "Elastic License v2"
 31name = "AWS EC2 NACL Entry Created or Replaced Allowing All Traffic by New Identity"
 32note = """## Triage and analysis
 33
 34### Investigating AWS EC2 NACL Entry Created or Replaced Allowing All Traffic by New Identity
 35
 36This rule fires when a NACL entry specifying all ports (0–65535) and all protocols is created or replaced. While NACLs are stateless and secondary to security groups, a permissive NACL entry can neutralize a defense-in-depth layer and may indicate an adversary attempting to ensure unrestricted connectivity for their tools or exfiltration channels.
 37
 38### Possible investigation steps
 39
 40- Identify the creating principal (`aws.cloudtrail.user_identity.arn`) and determine whether they are authorized to modify network ACLs.
 41- Review `aws.cloudtrail.request_parameters` to identify the NACL ID, rule number, egress/ingress direction, and CIDR block (`0.0.0.0/0` for any-source rules are highest severity).
 42- Determine which subnets are associated with the modified NACL and assess the sensitivity of workloads in those subnets.
 43- Check for accompanying security group modifications that also expand access.
 44- Review VPC flow logs for unusual traffic to or from the affected subnets following the NACL change.
 45- Review `event.outcome` — `success` means the permissive entry was applied and the subnet's network-layer controls are weakened now; `failure` means the change was blocked, which from a new identity often indicates credential probing or permission reconnaissance.
 46
 47### False positive analysis
 48
 49- Architectures that use NACLs as a stateless passthrough while relying on security groups for granular control may legitimately create permissive NACL entries.
 50- Development environments sometimes use open NACLs for convenience.
 51
 52### Response and remediation
 53
 54- If unauthorized, immediately delete the permissive NACL entry and replace it with an appropriately restrictive rule.
 55- Review VPC flow logs for evidence of network activity that exploited the open rule.
 56"""
 57references = [
 58    "https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CreateNetworkAclEntry.html",
 59    "https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ReplaceNetworkAclEntry.html",
 60]
 61risk_score = 47
 62rule_id = "5d9a3c71-2b84-4e58-f693-1c7f0a4e8b26"
 63setup = "The AWS CloudTrail integration must be enabled and configured to collect EC2 management events."
 64severity = "medium"
 65tags = [
 66    "Domain: Cloud",
 67    "Data Source: AWS",
 68    "Data Source: Amazon Web Services",
 69    "Data Source: AWS EC2",
 70    "Use Case: Threat Detection",
 71    "Tactic: Defense Evasion",
 72    "Resources: Investigation Guide",
 73]
 74timestamp_override = "event.ingested"
 75type = "new_terms"
 76
 77query = '''
 78data_stream.dataset: "aws.cloudtrail"
 79    and event.provider: "ec2.amazonaws.com"
 80    and event.action: ("CreateNetworkAclEntry" or "ReplaceNetworkAclEntry")
 81    and not aws.cloudtrail.user_identity.type: "AWSService"
 82    and event.outcome: ("success" or "failure")
 83    and aws.cloudtrail.flattened.request_parameters.aclProtocol: "-1"
 84    and aws.cloudtrail.flattened.request_parameters.ruleAction: "allow"
 85    and not user_agent.original: (*Terraform* or *terraform* or "cloudformation.amazonaws.com" or *pulumi* or *Pulumi*)
 86'''
 87
 88[[rule.threat]]
 89framework = "MITRE ATT&CK"
 90
 91[[rule.threat.technique]]
 92id = "T1562"
 93name = "Impair Defenses"
 94reference = "https://attack.mitre.org/techniques/T1562/"
 95
 96[[rule.threat.technique.subtechnique]]
 97id = "T1562.007"
 98name = "Disable or Modify Cloud Firewall"
 99reference = "https://attack.mitre.org/techniques/T1562/007/"
100
101[rule.threat.tactic]
102id = "TA0005"
103name = "Defense Evasion"
104reference = "https://attack.mitre.org/tactics/TA0005/"
105
106[rule.new_terms]
107field = "new_terms_fields"
108value = ["aws.cloudtrail.user_identity.arn"]
109[[rule.new_terms.history_window_start]]
110field = "history_window_start"
111value = "now-7d"
112
113[rule.investigation_fields]
114field_names = [
115    "@timestamp",
116    "aws.cloudtrail.user_identity.arn",
117    "aws.cloudtrail.user_identity.type",
118    "event.action",
119    "event.outcome",
120    "aws.cloudtrail.request_parameters",
121    "source.ip",
122    "cloud.region",
123    "cloud.account.id",
124]