LoFP / a single port being opened for a new service that is known to be deploying

Techniques

• t1190

Sample rules

Ingress/Egress Security Group Modification

• source: sigma
• technicques:
  • t1190

Description

Detects when an account makes changes to the ingress or egress rules of a security group. This can indicate that an attacker is attempting to open up new attack vectors in the account, that they are trying to exfiltrate data over the network, or that they are trying to allow machines in that VPC/Subnet to contact a C&C server.

Detection logic

condition: selection
selection:
  eventName:
  - AuthorizeSecurityGroupEgress
  - AuthorizeSecurityGroupIngress
  - RevokeSecurityGroupEgress
  - RevokeSecurityGroupIngress
  eventSource: ec2.amazonaws.com